Cryptographic system, cryptographic method, cryptographic program, and decryption device

ABSTRACT

In a functional encryption scheme where a decryption key dk can decrypt a ciphertext encrypted by an encryption key ek, when decrypting the encryption key in which a parameter Φ is set, by the decryption key dk in which a parameter Ψ is set, if and only if a relation R(Φ, Ψ) holds, a wider range as a relation R is expressed. Of first information including a polynomial d(x), plural polynomials D i (x), and predicate information, and second information including attribute information, a cryptographic system treats one as a ciphertext and a remaining one as a decryption key. A decryption device, based on the predicate information and attribute information, selects at least one of polynomials D i (x), and calculates a coefficient Δ i  enabling a polynomial constituted based on a polynomial Δ i D i (x) to be divided out by a polynomial d(x), the polynomial Δ i D i (x) obtained by multiplying the selected polynomial D i (x) by coefficient Δ i .

TECHNICAL FIELD

The present invention to a functional encryption scheme which utilizesthe notion of quadratic span program.

BACKGROUND ART

The functional encryption scheme is an encryption scheme that providesmore sophisticated and flexible relations between an encryption key ekand a decryption key dk.

According to the functional encryption scheme, a parameter Φ and aparameter Ψ are respectively set in the encryption key ek and thedecryption key dk. The decryption key dk can decrypt a ciphertextencrypted by the encryption key ek if and only if a relation R(Φ, Ψ)holds.

Non-Patent Literature 3 describes the functional encryption scheme.

Non-Patent Literature 6 describes the quadratic span program.

CITATION LIST Non-Patent Literature

-   Non-Patent Literature 1: Okamoto, T., Takashima, K.: Homomorphic    encryption and signatures from vector decomposition. In:    Galbraith, S. D., Paterson, K. G. (eds.) Pairing 2008. LNCS, vol.    5209, pp. 57-74, Springer Heidelberg (2008)-   Non-Patent Literature 2: Okamoto, T., Takashima, K.: Hierarchical    predicate encryption for inner-products, In: ASIACRYPT 2009,    Springer Heidelberg (2009)-   Non-Patent Literature 3: Okamoto, T., Takashima, K.: Fully secure    functional encryption with general relations from the decisional    linear assumption. In: Rabin, T. (ed.) CRYPTO 2010. LNCS, vol. 6223,    pp. 191-208. Springer Heidelberg (2010). Full version is available    at http://eprint.iacr.org/2010/563-   Non-Patent Literature 4: Okamoto, T., Takashima, K.: Efficient    attribute-based signatures for non-monotone predicates in the    standard model, In: PKC 2011, Springer Heidelberg (2011)-   Non-Patent Literature 5: Okamoto, T., Takashima, K.: Decentralized    Attribute-Based Signatures http://eprint.iacr.org/2011/701-   Non-Patent Literature 6: Rosario Gennaro and Craig Gentry and Bryan    Pamo and Mariana Raykova: Quadratic Span Programs and Succinct NIZKs    without PCPs http://eprint.iacr.org/2012/215

SUMMARY OF INVENTION Technical Problem

The functional encryption scheme described in Non-Patent Literature 3 isa scheme that utilizes linear span program. This functional encryptionscheme can express only a limited range as a relation R.

It is an object of the present invention to provide a functionalencryption scheme which, by utilizing the notion of quadratic spanprogram, can express a wider range as the relation R.

Solution to Problem

A cryptographic system according to the present invention includes:

an encryption device which generates one of first information includinga quadratic span program and second information including attributeinformation, as a ciphertext; and

a decryption device which, treating a remaining one of the firstinformation and the second information, as a decryption key, if thequadratic span program accepts the attribute information, decrypts theciphertext based on information obtained from the quadratic span programand the attribute information.

Advantageous Effects of Invention

The cryptographic system according to the present invention utilizes thenotion of the quadratic span program, so that an ideal range can beexpressed as the relation R.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 is an explanatory drawing of a quadratic span program.

FIG. 2 is an explanatory drawing of a subset L.

FIG. 3 is a configuration diagram of a cryptographic system 10 whichexecutes a KP-FE scheme.

FIG. 4 is a configuration diagram of a cryptographic system 10 whichexecutes a CP-FE scheme.

FIG. 5 is a configuration diagram of a key generation device 100according to Embodiment 2.

FIG. 6 is a configuration diagram of an encryption device 200 accordingto Embodiment 2.

FIG. 7 is a configuration diagram of a decryption device 300 accordingto Embodiment 2.

FIG. 8 is a flowchart showing the process of Setup algorithm accordingto Embodiment 2.

FIG. 9 is a flowchart showing the process of KeyGen algorithm accordingto Embodiment 2.

FIG. 10 is a flowchart showing the process of Enc algorithm according toEmbodiment 2.

FIG. 11 is a flowchart showing the process of Dec algorithm according toEmbodiment 2.

FIG. 12 is a flowchart showing the process of KeyGen algorithm accordingto Embodiment 4.

FIG. 13 is a diagram showing an example of the hardware configuration ofthe key generation device 100, the encryption device 200, and thedecryption device 300.

DESCRIPTION OF EMBODIMENTS

Embodiments of the present invention will be described hereinafter withreference to the accompanying drawings.

In the following description, a processing device is a CPU 911 (to bedescribed later) and the like. A storage device is a ROM 913, a RAM 914,a magnetic disk 920 (each will be described later), and the like. Acommunication device is a communication board 915 (to be describedlater) and the like. An input device is a keyboard 902, thecommunication board 915 (each will be described later), and the like.Namely, the processing device, the storage device, the communicationdevice, and the input device are hardware.

The notation in the following description will be explained.

When A is a random variable or distribution, Formula 101 denotes that yis randomly selected from A according to the distribution of A. Namely,in Formula 101, y is a random number.

$\begin{matrix}{y\overset{R}{arrow}A} & \lbrack {{Formula}\mspace{14mu} 101} \rbrack\end{matrix}$

When A is a set, Formula 102 denotes that y is uniformly selected fromA. Namely, in Formula 102, y is a uniform random number.

$\begin{matrix}{y\overset{U}{arrow}A} & \lbrack {{Formula}\mspace{14mu} 102} \rbrack\end{matrix}$

Formula 103 denotes that y is a set, defined or substituted by z.

y:=z  [Formula 103]

When a is a fixed value, Formula 104 denotes an event that a machine(algorithm) A outputs a on input x.

A(x)→a  [Formula 104]

For example,

A(x)→1

Formula 105, namely, F_(q), denotes a finite field of order q.

F _(q)  [Formula 105]

A vector symbol denotes a vector representation over the finite fieldF_(q). Namely, Formula 106 is established.

{right arrow over (x)} denotes

(x ₁ , . . . ,x _(n))ε

_(q) ^(n)  [Formula 106]

Formula 107 denotes the inner-product, indicated by Formula 109, of twovectors x^(→) and v^(→) indicated in Formula 108.

{right arrow over (x)}·{right arrow over (v)}  [Formula 107]

{right arrow over (x)}=(x ₁ , . . . ,x _(n)),

{right arrow over (v)}=(v ₁ , . . . ,v _(n))  [Formula 108]

Σ_(i=1) ^(n) x _(i) v _(i)  [Formula 109]

Note that X^(T) denotes the transpose of matrix M.

When b_(i) (i=1, . . . , n) is an element of a vector in a space V,namely, when Formula 110 is established, Formula 111 denotes thesubspace generated by Formula 112.

b _(i)ε

(i=1, . . . ,n)  [Formula 110]

span

b ₁ , . . . ,b _(n)

⊂

(resp. span

{right arrow over (x)} ₁ , . . . ,{right arrow over (x)} _(n)

)  [Formula 111]

b ₁ , . . . ,b _(n)(resp. {right arrow over (x)} ₁ , . . . ,{right arrowover (x)} _(n))  [Formula 112]

Note that for bases B and B* indicated in Formula 113, Formula 114 isestablished.

:=(b ₁ , . . . ,b _(N)),

*:=(b ₁ *, . . . ,b* _(N))  [Formula 113]

(x ₁ , . . . ,x _(N))

:=Σ_(i=1) ^(N) x _(i) b _(i),

(y ₁ , . . . ,y _(N))

*:=Σ_(i=1) ^(N) y _(i) b* _(i)  [Formula 114]

In the following description, when “Vt” is indicated as a subscript orsuperscript, Vt is V_(t). Likewise, when “δi,j” is indicated as asuperscript, δi,j is δ_(i,j). Likewise, when “fτ” and “κτ” are indicatedas superscripts, fτ is f_(τ), and κτ is κ_(τ).

When “→” indicating a vector is attached to a subscript or superscript,“→” is attached as a superscript to the subscript or superscript.

In the following description, a cryptographic process includes a keygeneration process, an encryption process, and a decryption process.

Embodiment 1

This embodiment describes a basic concept of the functional encryptionscheme that utilizes the quadratic span program, and the outline of thefunctional encryption scheme that utilizes the quadratic span program.

First, a space having a rich mathematical structure called “dual pairingvector spaces (DPVS)” which is a space for implementing the functionalencryption scheme will be described.

Second, a concept for implementing the functional encryption scheme willbe described. Here, “quadratic span program”, “equalities of attributeinformation, and quadratic span program”, and “secret distributionscheme” will be described.

Third, the outline of the functional encryption scheme that utilizes thequadratic span program will be described.

<2. Dual Pairing Vector Spaces>

First, symmetric bilinear pairing groups will be described. Thesymmetric bilinear pairing groups (q, G, G^(T), g, e) are a tuple of aprime q, a cyclic additive group G of order q, a cyclic multiplicativegroup G^(T) of order q, g≠0εG, and a polynomial-time computablenondegenerate bilinear pairing e:G×G→G_(T). The nondegenerate bilinearpairing signifies e(sg, tg)=e(g, g)^(st) where e(g, g)≠1.

In the following description, let G_(bpg) be an algorithm that takes asinput 1^(λ) and outputs the value of a parameter param_(G):=(q, G,G_(T), g, e) of bilinear pairing groups with a security parameter λ.

Dual pairing vector spaces will now be described.

The dual pairing vector spaces (q, V, G_(T), A, e) can be constituted bya direct product of symmetric bilinear pairing groups (param_(G):=(q, G,G_(T), g, e)). The dual pairing vector spaces (q, V, G_(T), A, e) are atuple of a prime q, an N-dimensional vector space V over F_(q) indicatedin Formula 115, a cyclic group G_(T) of the order q, and a canonicalbasis A:=(a₁, . . . , a_(N)) of a space V, and have the followingoperations (1) and (2) where a_(i) is as indicated by Formula 116.

$\begin{matrix}{:=\overset{\overset{N}{}}{\times \ldots \mspace{14mu} \times}} & \lbrack {{Formula}\mspace{14mu} 115} \rbrack \\{a_{i}:=( {\overset{\overset{i - 1}{}}{0,\ldots \mspace{14mu},0},g,\overset{\overset{N - i}{}}{0,\ldots \mspace{14mu},0}} )} & \lbrack {{Formula}\mspace{14mu} 116} \rbrack\end{matrix}$

Operation (1): Nondegenerate Bilinear Pairing

The pairing on the space V is defined by Formula 117.

e(x,y):=Π_(i=1) ^(N) e(G _(i) ,H _(i))ε

_(T)  [Formula 117]

where

(G ₁ , . . . ,G _(N)):=xε

,

(H ₁ , . . . ,H _(N)):=yε

This is nondegenerate bilinear, i.e., e(sx, ty)=e(s, y)^(st) and if e(x,y)=1 for all yεV then x=0. For all i and j, e(a_(i), a_(j))=e(g,g)^(δi,j) where δ_(i,j)=1 if i=j, and δ_(i,j)=0 if i≠j. Also, e(g,g)≠1εG_(T).

Operation (2): Distortion Maps

Linear transformation φ_(i,j) on the space V indicated in Formula 118can achieve Formula 119.

$\begin{matrix}{{\varphi_{i,j}( a_{j} )} = {{{a_{i}\mspace{14mu} {if}\mspace{14mu} k} \neq {j\mspace{14mu} {then}\mspace{14mu} {\varphi_{i,j}( a_{k} )}}} = 0}} & \lbrack {{Formula}\mspace{14mu} 118} \rbrack \\{{{\varphi_{i,j}(x)}:=( {\overset{\overset{i - 1}{}}{0,\ldots \mspace{14mu},0},g_{j},\overset{\overset{N - i}{}}{0,\ldots \mspace{14mu},0}} )}{{{Note}\mspace{14mu} {that}\mspace{14mu} ( {g_{1},{\ldots \mspace{14mu} g_{N}}} )}:=x}} & \lbrack {{Formula}\mspace{14mu} 119} \rbrack\end{matrix}$

Linear transformation φ_(i,j) will be called distortion maps.

In the following description, let G_(dpvs) be an algorithm that takes asinput, 1^(λ) (λε natural number), Nεnatural number, and the values ofthe parameter param_(G):=(q, G, G_(T), g, e) of bilinear pairing groups,and outputs the value of a parameter param_(v):=(q, V, G_(T), A, e) ofdual pairing vector spaces which have a security parameter λ and whichform an N-dimensional space V.

A case will be described where dual pairing vector spaces areconstructed from the symmetric bilinear pairing groups described above.Dual pairing vector spaces can be constructed from asymmetric bilinearpairing groups as well. The following description can be easily appliedto a case where dual pairing vector spaces are constructed fromasymmetric bilinear pairing groups.

<2. Concept for Implementing Functional Encryption>

<2-1. Quadratic Span Program>

FIG. 1 is an explanatory drawing of a quadratic span program.

The quadratic span program over the field F_(q) includes two polynomialsets, i.e., a set A={a_(i)(x)|iε{0, . . . , L}} and a setB={b_(i)(x)|iε{0, . . . , L}}, and a target polynomial d(x). Thequadratic span program includes a label ρ of a set I:={1, . . . , L}.All labels ρ_(i)(i=1, . . . , L) are each related to one literal of {p₀,p₁, . . . , p_(n),

p₁, . . . ,

p_(n)}, namely, ρ:I→{p₀, p₁, . . . , p_(n),

p₁, . . . ,

p_(n)}.

For an input u:=(u₁, . . . , u_(n))ε{0, 1}^(n), a true value T of theliteral is set from T(p_(j)):=u_(j) and T(

p_(j)):=

u_(j) concerning each integer j of j=1, . . . , n. For any input u, 1 isset as the true value T of p_(o). Namely, T(p₀):=1.

A subset I_(u) of the set I is constructed from the elements of a labelfor which 1 is set upon input u. Namely, I_(u):={iεI|T(p(i)=1)}.Alternatively, I_(u):={iεI|[ρ(i)=p_(j)

u_(j)=1]

[ρ(i)=

p_(j)

u_(j)=0]

[ρ(i)=p_(O)]}.

FIG. 2 is an explanatory drawing of the subset I_(u).

Note that in FIG. 2, n=7 and L=6. Also, in FIG. 2, assume that thelabels ρ are related such that ρ₁ corresponds to

p₂, ρ₂ to p₁, ρ₃ to p₄, ρ₄ to

p₅, ρ₅ to

p₃, and ρ₆ to p₅.

Regarding input u:=(u₁, . . . , u₇)ε{0, 1}⁷, assume that u₁=1, u₂=0,u₃=1, u₄=0, u₅=0, u₆=1, and u₇=1. In this case, the subset I_(u)consists of elements i of labels ρ_(i) related to literals (p₁, p₃, p₆,p₇,

p₂,

p₄,

p₅) surrounded by broken lines. That is, the subset I_(u) consists ofthe elements i of labels ρ₁, ρ₂, and ρ₄, thus the subset I_(u):={i=1, 2,4}.

The quadratic span program accepts input uΣ{1, 0}^(n) (or accepts thesubset I_(u)) if and only if a tuple of (α₁, . . . , α_(L)) and (β₁, . .. , β_(L)) exists where α_(i)=0=β_(i) concerning every i not included inthe subset I_(u), the tuple of (α₁, . . . , α_(L)) and (β₁, . . . ,β_(L)) being a tuple over a field F_(q) ^(L) in which the targetpolynomial d(x) divides out Formula 120. Otherwise, the quadratic spanprogram rejects input uΣ{1, 0}^(n).

$\begin{matrix}{( {{a_{0}(x)} + {\sum\limits_{i = 1}^{L}\; {\alpha_{i} \cdot {a_{i}(x)}}}} ) \cdot ( {{b_{0}(x)} + {\sum\limits_{i = 1}^{L}\; {\beta_{i} \cdot {b_{i}(x)}}}} )} & \lbrack {{Formula}\mspace{14mu} 120} \rbrack\end{matrix}$

That is, the quadratic span program accepts input uε{1, 0}^(n) if andonly if a tuple of α_(i) and β_(i) exists concerning iεI_(u) in whichthe target polynomial d(x) divides out Formula 121.

$\begin{matrix}{( {{a_{0}(x)} + {\sum\limits_{i \in \mathcal{I}}^{\;}\; {\alpha_{i} \cdot {a_{i}(x)}}}} ) \cdot ( {{b_{0}(x)} + {\sum\limits_{i\; \in \mathcal{I}}^{\;}\; {\beta_{i} \cdot {b_{i}(x)}}}} )} & \lbrack {{Formula}\mspace{14mu} 121} \rbrack\end{matrix}$

If the quadratic span program accepts input uΣ{1, 0}^(n), the tuple ofα_(i) and β_(i) concerning iεI_(u) is polynomial-time computable (seeNon-Patent Literature 6).

With the example shown in FIG. 2, the quadratic span program acceptsinput uε{1, 0}^(n) if and only if a tuple of α_(i) and β_(i) existsconcerning iεI_(u):={i=1, 2, 4} in which the target polynomial d(x)divides out Formula 121.

$\begin{matrix}{( {{a_{0}(x)} + {\sum\limits_{i \in {\{{1,2,4}\}}}^{\;}\; {\alpha_{i} \cdot {a_{i}(x)}}}} ) \cdot ( {{b_{0}(x)} + {\sum\limits_{i\; \in {\{{1,2,4}\}}}^{\;}\; {\beta_{i} \cdot {b_{i}(x)}}}} )} & \lbrack {{Formula}\mspace{14mu} 122} \rbrack\end{matrix}$

<2-2. Inner-Product of Attributes and Quadratic Span Program>

U_(t) (t=1, . . . , d and U_(t)⊂{0, 1}*) is a sub-universe and anattribute set. Each U_(t) includes identification information (t) of thesub-universe and attribute information (v^(→)) expressed as ann-dimensional vector. Namely, U_(t) is (t, v^(→))) where tε{1, . . . ,d} and v^(→)εF_(q) ^(n).

Let U_(t):=(t, v^(→)) be p, that is, p:=(t, v^(→)). An explanation willbe given on a method of determining the subset L in a quadratic spanprogram Q:=(A, B, d(x), ρ) by p_(j):=(t, v^(→) _(j))(j=1, . . . , n;tε{1, . . . , d}).

Let an access structure S be a quadratic span program Q:=(A, B, d(x), ρ)accompanying p₀ and {p_(i):=(t, v^(→) _(j))}_(j=1, . . . , n). That is,ρ:{1, . . . , L}→{p₀, (t, v^(→) ₁), . . . , (t, v^(→) _(n)),

(t, v^(→) ₁), . . . ,

(t, v^(→) _(n))}. Let Γ be an attribute set, that is, Γ:={(t, x^(→)_(t))|x^(→) _(t)εF_(q) ^(n), 1≦t≦d}. Note that t is a subset of {1, . .. , d} and need not be all indexes.

When an attribute set Γ is given to the access structure S, a true valueT of the literals {p₀, p₁, . . . , p_(n),

p₁, . . . ,

p_(n)} is determined as follows. T(p_(j)):=1 if and only if p_(j)=(t,v^(→) _(j)) and (t, v^(→) _(t))εΓ and v^(→) _(j)·x^(→) _(t)ε0. T(

p_(j))):=1 if and only if p_(j)=

(t, v^(→) _(j)) and (t, x^(→) _(j))εΓ and v^(→) _(j)·x^(→) _(t)≠0.T(p₀):=1. Otherwise, the true value T is 0.

Also, I_(u) (=I_((ρ,Γ)):={iεI|T(ρ(i))=1}, that is,I_((ρ,Γ)):={iεI|[ρ(i)=(t, v^(→) _(j))

(t, x^(→) _(t))εΓ

(v^(→) _(j)·x^(→) _(t))=0]

[(ρ(i)=

(t, v^(→) _(j))

(t, v^(→) _(j))εΓ

v^(→) _(j)·x^(→) _(t)≠0]

[ρ(i)=p₀]}.

<3. Outline of Functional Encryption Scheme>

A functional encryption scheme is constituted by letting one of adecryption key and a ciphertext have the access structure S describedabove and the other one have the attribute set Γ.

A functional encryption scheme in which a decryption key has an accessstructure S is called Key-Policy functional encryption (KP-FE) scheme,and an encryption scheme in which a ciphertext has an access structure Sis called Ciphertext-Policy functional encryption (CP-FE) scheme.

The structures of the KP-FE scheme and CP-FE scheme and the structuresof cryptographic systems 10 that execute the respective schemes will bedescribed.

<3-1. KP-FE Scheme>

The KP-FE scheme consists of four algorithms: Setup, KeyGen, Enc, andDec.

(Setup)

The Setup algorithm is a randomized algorithm that takes as input asecurity parameter λ and outputs public parameters pk and a master keysk.

(KeyGen)

The KeyGen algorithm is a randomized algorithm that takes as input anaccess structure S, the public parameters pk, and the master key sk, andoutputs a decryption key sk_(S).

(Enc)

The Enc algorithm is a randomized algorithm that takes as input amessage msg, an attribute set Γ:={(t, x^(→) _(t))|x^(→) _(t)εF_(q) ^(n),1≦t≦d}, and the public parameters pk, and outputs a ciphertext ct_(Γ).

(Dec)

The Dec algorithm is an algorithm that takes as input the ciphertextct_(Γ) encrypted under the attribute set Γ, the decryption key sk_(S)for the access structure S, and the public parameters pk, and outputseither the message msg or distinguished symbol ⊥.

FIG. 3 is a configuration diagram of a cryptographic system 10 thatexecutes the KP-FE scheme.

The cryptographic system 10 is provided with a key generation device100, an encryption device 200, and a decryption device 300.

The key generation device 100 executes the Setup algorithm by taking asinput a security parameter X, and generates public parameters pk and amaster key sk. The key generation device 100 publicizes the generatedpublic parameters pk. The key generation device 100 also executes theKeyGen algorithm by taking as input an access structure S, generates adecryption key sk_(S), and distributes the decryption key sk_(S) to thedecryption device 300 in secrecy.

The encryption device 200 executes the Enc algorithm by taking as inputa message msg, an attribute set Γ, and the public parameters pk, andgenerates a ciphertext ct_(Γ). The encryption device 200 transmits thegenerated ciphertext ct_(Γ) to the decryption device 300.

The decryption device 300 executes the Dec algorithm by taking as inputthe public parameters pk, the decryption key sk_(S), and the ciphertextct_(Γ), and outputs a message msg or distinguished symbol ⊥.

<3-2. CP-FE Scheme>

The CP-FE scheme consists of four algorithms: Setup, KeyGen, Enc, andDec.

(Setup)

The Setup algorithm is a randomized algorithm that takes as input asecurity parameter λ and outputs public parameters pk and a master keysk.

(KeyGen)

The KeyGen algorithm is a randomized algorithm that takes as input anattribute set Γ:={(t, x^(→) _(t))|x^(→) _(t)εF_(q) ^(n), 1≦t≦d}, thepublic parameters pk, and the master key sk, and outputs a decryptionkey sk_(S).

(Enc)

The Enc algorithm is a randomized algorithm that takes as input amessage msg, an access structure S, and the public parameters pk, andoutputs a ciphertext ct_(S).

(Dec)

The Dec algorithm is an algorithm that takes as input the ciphertextct_(S) encrypted under the access structure S, a decryption key sk_(Γ)for the attribute set Γ, and the public parameters pk, and outputs amessage msg or distinguished symbol 1.

FIG. 4 is a configuration diagram of a cryptographic processing system10 that executes the CP-FE scheme.

The cryptographic processing system 10 is provided with a key generationdevice 100, an encryption device 200, and a decryption device 300.

The key generation device 100 executes the Setup algorithm by taking asinput a security parameter λ and generates public parameters pk and amaster key sk. The key generation device 100 publicizes the generatedpublic parameters pk. The key generation device 100 also executes theKeyGen algorithm by taking as input an attribute set Γ, generates adecryption key sk_(Γ), and distributes the decryption key sk_(Γ) to thedecryption device 300 in secrecy.

The encryption device 200 executes the Enc algorithm by taking as inputa message msg, an access structure S, and the public parameters pk, andgenerates a ciphertext ct_(S). The encryption device 200 transmits thegenerated ciphertext ct_(S) to the decryption device 300.

The decryption device 300 executes the Dec algorithm by taking as inputthe public parameters pk, the decryption key sk_(Γ), and the ciphertextct_(S), and outputs a message msg or distinguished symbol ⊥.

In both the KP-FE scheme and the CP-FE scheme, with the Dec algorithm,based on the access structure S and the attribute set Γ, a subsetI_((ρ,Γ)) is selected by the method described above, and furthermore acoefficient (α₁, . . . , α_(L)) and a coefficient (β₁, . . . , β_(L))are specified. Based on the subset I_((ρ,Γ)), the coefficient (α₁, . . ., α_(L)), and the coefficient (β₁, . . . , β_(L)), the ciphertext ct_(Γ)(or ct_(s)) is decrypted and the message msg is calculated.

Normally, the Setup algorithm is executed only once at the setup of thesystem. The KeyGen algorithm is executed each time the user decryptionkey is to be generated. The Enc algorithm is executed each time themessage msg is to be encrypted. The Dec algorithm is executed each timethe ciphertext is to be decrypted.

In the cryptographic system 10 according to Embodiment 1, the functionalencryption scheme is constituted using the access structure S which isbased on the quadratic span program. As a result, an ideal range can beexpressed as a relation R.

Embodiment 2

In Embodiment 2, an explanation will be given on a configuration exampleof a functional encryption scheme that utilizes a quadratic spanprogram.

The KP-FE scheme is the example to be explained.

FIG. 5 is a configuration diagram of a key generation device 100according to Embodiment 2. FIG. 6 is a configuration diagram of anencryption device 200 according to Embodiment 2. FIG. 7 is aconfiguration diagram of a decryption device 300 according to Embodiment2.

FIGS. 8 and 9 are flowcharts showing the operation of the key generationdevice 100, in which FIG. 8 is a flowchart showing the process of theSetup algorithm, and FIG. 9 is a flowchart showing the process of theKeyGen algorithm. FIG. 10 is a flowchart showing the operation of theencryption device 200, being the process of the Enc algorithm. FIG. 11is a flowchart showing the operation of the decryption device 300, beingthe process of the Dec algorithm.

The function and operation of the key generation device 100 will bedescribed.

The key generation device 100 is provided with a master key generationpart 110, a master key storage part 120, an information input part 130,a decryption key generation part 140, and a key distribution part 150.The decryption key generation part 140 is provided with a secretinformation generation part 141 and a key element generation part 142.

The process of the Setup algorithm will be described with reference toFIG. 8.

(S101: Orthogonal Basis Generation Step)

With the processing device, the master key generation part 110calculates Formula 123, to generate parameters param, bases B₀ and B*₀,and base s B_(t) and B*_(t).

$\begin{matrix}\lbrack {{Formula}\mspace{14mu} 123} \rbrack & \; \\{{input}\mspace{14mu} 1^{\lambda}} & (1) \\{{param}_{}:={( {q,,_{T},g,e} )\overset{R}{}{_{bpg}( 1^{\lambda} )}}} & (2) \\{\psi \overset{U}{}_{q}^{x}} & (3) \\{{n_{0}:={{2\; {mf}_{\max}} + 1}},{n_{t}:={{2\; {mf}_{\max}k_{\max}} + {n( {{t = 1},\ldots \mspace{14mu},d} )}}},{N_{0}:={n_{0} + u_{0} + w_{0} + z_{0}}},{N_{t}:={n_{t} + u_{t} + w_{t} + {z_{t}( {{t = 1},\ldots \mspace{14mu},d} )}}}} & (4)\end{matrix}$

Processes of (5) to (9) are executed concerning each t of t=0, . . . ,d.

param  t := ( q ,  t ,  T ,  t , e ) :=  dpvs  ( 1 λ , N t , param ) ( 5 ) X t := ( χ t , i , j ) i , j = 1 , …  , N t   U  GL  ( Nt , q ) ( 6 ) X t * := ( ϑ t , i , j ) i , j = 1 , …  , N t := ψ · ( Xt T ) - 1 ( 7 ) b t , i := ( χ → t , i )   t = ∑ j = 1 N t   χ t , i, j  a t , j   for   i = 1 , …  , N t ,   t := ( b t , 1 , …  ,b t , N t ) ( 8 ) b t , i * := ( ϑ → t , i )   t = ∑ j = 1 N t   ϑ t, i , j  a t , j   for   i = 1 , …  , N t ,   t * := ( b t , 1 *, …  , b t , N t * ) ( 9 ) g T := e  ( g , g )  ψ ,  param := ( {param  t } t = 0 , …  , d , gT ) ( 10 )

Namely, the master key generation part 110 executes the followingprocesses.

(1) With the input device, the master key generation part 110 takes asinput the security parameter λ(1^(λ)).

(2) With the processing device, the master key generation part 110executes the algorithm G_(bpg) by taking as input the security parameterλ inputted in (1), and generates the value of parameters param_(G):=(q,G, G_(T), g, e) of bilinear pairing groups.

(3) With the processing device, the master key generation part 110generates a random number ψ.

(4) The master key generation part 110 sets n₀+n₀+w₀+z₀ in N₀, and setsn_(t)+u_(t)+w_(t)+z_(t) in N_(t) concerning each integer t of t=1, . . ., d (d is an integer of 1 or more). Note that n₀ is 2mf_(max)+1 andn_(t) is 2mf_(max)k_(max)+n where: m is the number of factors obtainedby factorizing the target polynomial d(x); f_(in). is the maximum value(maximum value of f_(τ) to be described later) of the degrees of thefactors obtained by factorizing the target polynomial d(x); k_(max) isthe maximum value of the number of labels ρ related to one piece ofidentification information t; n is an integer of 1 or more; and u₀, w₀,z₀, u_(t), w_(t), and z_(t) are each an integer of 0 or more.

Subsequently, the master key generation part 110 executes the followingprocesses (5) to (9) concerning each integer t of t=0, . . . , d.

(5) With the processing device, the master key generation part 110executes algorithm G_(dpvs) by taking as input the security parameter λinputted in (1), N_(t) set in (4), and the values of param_(G):=(q, G,G_(T), g, e) generated in (2), and generates the values of parametersparam_(Vt):=(q, V_(t), G_(T), A_(t), e) of the dual pairing vectorspaces.

(6) With the processing device, the master key generation part 110 takesas input N_(t) set in (4), and F_(q), and generates lineartransformation X_(t):=(χ_(t,i,j))_(i,j) randomly. Note that GL standsfor General Linear. Namely, GL is a general linear group, a set ofsquare matrices in which the determinant is not 0, and a group withrespect to multiplication. Note that (χ_(t,i,j))_(i,j) signifies amatrix concerning suffixes i and j of a matrix χ_(t,i,j) where i, j=1, .. . , N_(t).

(7) With the processing device and based on the random number ψ and thelinear transformation X_(t), the master key generation part 110generates X*_(t):=(ν_(t,i,j))_(i,j):=ψ·(X_(t) ^(T))⁻¹. As(χ_(t,i,j))_(i,j) does, (ν_(t,i,j))_(i,j) signifies a matrix concerningsuffixes i and j of a matrix ν_(t,i,j) where i, j=1, . . . , N_(t).

(8) With the processing device and based on the linear transformationX_(t) generated in (6), the master key generation part 110 generates abasis B_(t) from a canonical basis A_(t) generated in (5). Note thatx^(→) _(t,i) indicates the i-th row of the linear transformation X_(t).

(9) With the processing device and based on the linear transformationX*_(t) generated in (7), the master key generation part 110 generates abasis B*_(t) from the canonical basis A_(t) generated in (5). Note thatv^(→) _(t,i) indicates the i-th row of the linear transformation X*_(t).

(10) With the processing device, the master key generation part 110 setse(g, g)_(ψ) in g_(T). The master key generation part 110 also sets g_(t)and {param_(Vt)}_(t=0, . . . , d) generated in (5), in param.

In brief, in (S101), the master key generation part 110 executesalgorithm G_(ob) indicated in Formula 124, and generates param, thebases B₀ and B*₀, and the bases B_(t) and B*_(t).

$\begin{matrix}{\mspace{79mu} {{{_{ob}( 1^{\lambda} )}\text{:}}{{{param}_{}:={( {q,,_{T},g,e} )\overset{R}{}{_{bpg}( 1^{\lambda} )}}},{\psi \overset{U}{}_{q}^{x}},{n_{0}:={{2\; {mf}_{\max}} + 1}},{n_{t}:={{2\; {mf}_{\max}k_{\max}} + {n( {{t = 1},\ldots \mspace{14mu},d} )}}},{N_{0}:={n_{0} + u_{0} + w_{0} + z_{0}}},{N_{t}:={n_{t} + u_{t} + w_{t} + {z_{t}( {{t = 1},\ldots \mspace{14mu},d} )}}},\mspace{20mu} {{{for}\mspace{14mu} t} = 0},\ldots \mspace{14mu},d,{{param}_{_{t}}:={( {q,_{t},_{T},_{t},e} ):={_{dpvs}( {1^{\lambda},N_{t},{param}_{}} )}}},\mspace{79mu} {X_{t}:={( \chi_{t,i,j} )_{i,{j = 1},\ldots \mspace{14mu},N_{t}}\overset{U}{}{{GL}( {N_{t},_{q}} )}}},\mspace{79mu} {X_{t}^{*}:={( \vartheta_{t,i,j} )_{i,{j = 1},\ldots \mspace{14mu},N_{t}}:={\psi \cdot ( X_{t}^{T} )^{- 1}}}},{hereafter},{\overset{arrow}{\chi}}_{t,i}}{{{{and}\mspace{14mu} {\overset{arrow}{\vartheta}}_{t,i}\mspace{14mu} {denote}\mspace{14mu} {the}\mspace{14mu} i\text{-}{th}\mspace{14mu} {rows}\mspace{14mu} {of}\mspace{14mu} X_{t}\mspace{14mu} {and}\mspace{14mu} X_{t}^{*}\mspace{14mu} {for}\mspace{14mu} i} = 1},\ldots \mspace{14mu},N_{t},{respectively},\mspace{20mu} {b_{t,i}:={{( {\overset{arrow}{\chi}}_{t,i} )_{t}} = {{\sum\limits_{j = 1}^{N_{t}}\; {\chi_{t,i,j}a_{t,j}\mspace{14mu} {for}\mspace{14mu} i}} = 1}}},\ldots \mspace{14mu},N_{t},\mspace{20mu} {_{t}:=( {b_{t,1},\ldots \mspace{14mu},b_{t,N_{t}}} )}}\mspace{20mu} {{b_{t,i}^{*}:={{( {\overset{arrow}{\vartheta}}_{t,i} )_{t}} = {{\sum\limits_{j = 1}^{N_{t}}\; {\vartheta_{t,i,j}a_{t,j}\mspace{14mu} {for}\mspace{14mu} i}} = 1}}},\ldots \mspace{14mu},N_{t},\mspace{20mu} {_{t}^{*}:=( {b_{t,1}^{*},\ldots \mspace{14mu},b_{t,N_{t}}^{*}} )},{g_{T}:={{e( {g,g} )}\psi}},{{param}:=( {\{ {param}_{_{t}} \}_{{t = 0},\ldots \mspace{14mu},d},{gT}} )},\mspace{20mu} {{return}\mspace{14mu} {( {{param},_{t},_{t}^{*}} ).}}}}} & \lbrack {{Formula}\mspace{14mu} 124} \rbrack\end{matrix}$

(S102: Public Parameter Generation Step)

With the processing device, the master key generation part 110 generatessubbases B̂₀ and B̂_(t) of the bases B₀ and B_(t), respectively, which aregenerated in (S101), as indicated in Formula 125.

₀=(b _(0,1) ,b _(0,n) ₀ _(+u) ₀ _(+w) ₀ ₊₁ , . . . ,b _(0,n) ₀ _(+u) ₀_(+w) ₀ _(+z) ₀ ),

_(t):=(b _(t,1) , . . . ,b _(t,n) ,b _(t,n) _(t) _(+u) _(t) _(+w) _(t)₊₁ , . . . ,b _(t,n) _(t) _(+u) _(t) _(+w) _(t) _(+z) _(t) ) for t=1, .. . ,d  [Formula 125]

The master key generation part 110 treats the generated subbases BA₀ andB^(A) _(t), the security parameter λ inputted in (S101), and paramgenerated in (S101), to form the public parameters pk.

(S103: Master Key Generation Step)

With the processing device, the master key generation part 110 generatessubbases B̂*₀ and B̂*_(t) of the bases B*₀ and basis B*₆ respectively,which are generated in (S101), as indicated in Formula 126.

*₀:=(b* _(0,1) , . . . ,b* _(0,n) ₀ ,b* _(0,n) ₀ _(+u) ₀ ₊₁ ,b* _(0,n) ₀_(+u) ₀ _(+w) ₀ ,b* _(0n) ₀ _(+u) ₀ _(+w) ₀ _(+z) ₀ ),

*_(t):=(b* _(t,1) , . . . ,b* _(t,n) _(t) ,b* _(t,n) _(t) _(+u) _(t) ₊₁, . . . ,b* _(t,n) _(t) _(+u) _(t) _(+w) _(t) ) for t=1, . . .,d  [Formula 126]

The master key generation part 110 treats the generated subbases B̂*₀ andB̂*_(t), to form the master key sk.

(S104: Master Key Storing Step)

The master key storage part 120 stores the public parameters pkgenerated in (S102), in the storage device. The master key storage part120 also stores the master key sk generated in (S103), in the storagedevice.

In brief, from (S101) through (S103), the key generation device 100generates the public parameters pk and the master key sk by executingthe Setup algorithm indicated in Formula 127. Then, in (S104), the keygeneration device 100 stores the generated public parameters pk andmaster key sk, in the storage device.

Note that the public parameters are publicized via, e.g., a network, sothe encryption device 200 and decryption device 300 can acquire them.

$\begin{matrix}{\mspace{79mu} {{{{Setup}( 1^{\lambda} )}\text{:}}\mspace{20mu} {( {{param},( {_{t},_{t}^{*}} )_{{t = 0},\ldots \mspace{14mu},d}} )\overset{R}{}{_{ob}( 1^{\lambda} )}}\mspace{20mu} {{{\hat{}}_{0}:=( {b_{0,1},b_{0,{n_{0} + u_{0} + w_{0} + 1}},\ldots \mspace{14mu},b_{0,{n_{0} + u_{0} + w_{0} + z_{0}}}} )},{{\hat{}}_{t}:=( {b_{t,1},\ldots \mspace{14mu},b_{t,n},b_{t,{n_{t} + u_{t} + w_{t} + 1}},\ldots \mspace{14mu},b_{t,{n_{t} + u_{t} + w_{t} + z_{t}}}} )}}\mspace{20mu} {{{{for}\mspace{14mu} t} = 1},\ldots \mspace{14mu},d,{{\hat{}}_{0}^{*}:=( {b_{0,1}^{*},\ldots \mspace{14mu},b_{0,n_{0}}^{*},b_{0,{n_{0} + u_{0} + 1}}^{*},\ldots \mspace{14mu},b_{0,{n_{0} + u_{0} + w_{0}}}^{*},b_{0,{n_{0} + u_{0} + w_{0} + z_{0}}}^{*}} )},{{\hat{}}_{t}^{*}:=( {b_{t,1}^{*},\ldots \mspace{14mu},b_{t,n_{t}}^{*},b_{t,{n_{t} + u_{t} + 1}}^{*},\ldots \mspace{14mu},b_{t,{n_{t} + u_{t} + w_{t}}}^{*}} )}}\mspace{20mu} {{{{for}\mspace{14mu} t} = 1},\ldots \mspace{14mu},d,\mspace{20mu} {{{return}\mspace{14mu} {pk}}:=( {1^{\lambda},\{ {\hat{}}_{t} \}_{{t = 0},\ldots \mspace{14mu},d},{param}} )},\mspace{20mu} {{sk}:={\{ {\hat{}}_{t}^{*} \}_{{t = 0},\ldots \mspace{14mu},d}.}}}}} & \lbrack {{Formula}\mspace{14mu} 127} \rbrack\end{matrix}$

The process of the KeyGen algorithm will be described with reference toFIG. 9.

(S201: Information Input Step)

With the input device, the information input part 130 takes as input theaccess structure S:=(A, B, d(x), ρ) described above. Note that theattribute information of the user of the decryption key sk_(S) is set inρ. The target polynomial d(x) included in the access structure S can befactorized into m of factors d_(τ)(x)^(fτ) where t=1, . . . , m, asindicated in Formula 128.

$\begin{matrix}{{d(x)} = {\prod\limits_{\tau = 1}^{m}\; {d_{\tau}(x)}^{f_{\tau}}}} & \lbrack {{Formula}\mspace{14mu} 128} \rbrack\end{matrix}$

(S202: Secret Information it Generation Step)

With the processing device, the secret information generation part 141generates secret information π_(τ,κ,0) and secret information π_(τ,κ,1),as indicated in Formula 129.

$\begin{matrix}{{\pi_{\tau}\overset{U}{arrow}_{q}},( {{\tau = 1},\ldots \mspace{14mu},{m - 1}} ),{\pi_{m}:={- {\sum\limits_{\tau = 1}^{m - 1}\; \pi_{\tau}}}},{\pi_{\tau,\kappa,0}\overset{U}{arrow}_{q}},{\pi_{\tau,\kappa,1}:={\pi_{\tau} - {\pi_{\tau,\kappa,0}( {{\tau = 1},\ldots \mspace{14mu},{m;{\kappa = 0}},\ldots \mspace{11mu},f_{\tau}} )}}}} & \lbrack {{Formula}\mspace{14mu} 129} \rbrack\end{matrix}$

(S203: Secret Information χ Generation Step)

With the processing device, the secret information generation part 141generates secret information χ_(τ,κ,0) and secret information χ_(τ,κ,1)as indicated in Formula 130.

$\begin{matrix}{{\chi_{\tau}\overset{U}{arrow}_{q}},( {{\tau = 1},\ldots \mspace{14mu},{m - 1}} ),{\chi_{m}:={1 - {\sum\limits_{\tau = 1}^{m - 1}\chi_{\tau}}}},{\chi_{\tau,\kappa,0}\overset{U}{arrow}_{q}},{\chi_{\tau,\kappa,1}:={\chi_{\tau} - {\chi_{\tau,\kappa,0}( {{\tau = 1},\ldots \mspace{11mu},{m;{\kappa = 0}},\ldots \mspace{14mu},f_{\tau}} )}}}} & \lbrack {{Formula}\mspace{14mu} 130} \rbrack\end{matrix}$

(S204: Secret Information s Generation Step)

With the processing device, the secret information generation part 141generates secret information s₀ ^((τ,κ,0)) and secret information s₀^((τ,κ,1)), and secret information s_(i) ^((τ,κ,0)) and secretinformation s_(i) ^((τ,κ,1)), as indicated in Formula 131.

$\begin{matrix}{\mspace{79mu} {{{{{for}\mspace{14mu} \tau} = 1},\ldots \mspace{14mu},m,\mspace{20mu} {\kappa = 0},\ldots \mspace{14mu},f_{\tau},\mspace{20mu} {\iota = 0},1,\mspace{20mu} {\mu^{({\tau,\kappa,0})}:={\deg ( {d_{\tau}(x)}^{\kappa} )}},\mspace{20mu} {\mu^{({\tau,\kappa,1})}:={\deg ( {{d_{\tau}(x)}f_{\tau}^{- \kappa}} )}},\mspace{20mu} ( {{\kappa = 0},\ldots \mspace{14mu},f_{\tau}} ),{{a_{i,0}^{({\tau,\kappa})} + {a_{i,1}^{({\tau,\kappa})}x} + \ldots + {a_{i,{\mu^{({\tau,\kappa,0})} - 1}}^{({\tau,\kappa})}x^{\mu^{({\tau,\kappa,0})} - 1}}}:={{a_{i}(x)}{mod}\mspace{14mu} {d_{\tau}(x)}^{\kappa}}},{{b_{i,0}^{({\tau,\kappa})} + {b_{i,1}^{({\tau,\kappa})}x} + \ldots + {b_{i,{\mu^{({\tau,\kappa,1})} - 1}}^{({\tau,\kappa})}x^{\mu^{({\tau,\kappa,1})} - 1}}}:={{b_{i}(x)}{mod}\mspace{14mu} {d_{\tau}(x)}f_{\tau}^{- \kappa}}},\mspace{20mu} {\delta_{j}^{({\tau,\kappa,\iota})}\overset{U}{arrow}{_{q}( {{j = 0},\ldots \mspace{14mu},{\mu^{({\tau,\kappa,\iota})} - 1}} )}}}\mspace{20mu} {{s_{0}^{({\tau,\kappa,0})}:={\sum\limits_{j = 0}^{\mu^{({\tau,\kappa,0})} - 1}\; {\delta_{j}^{({\tau,\kappa,0})} \cdot a_{0,j}^{({\tau,\kappa})}}}},\mspace{20mu} {s_{0}^{({\tau,\kappa,1})}:={\sum\limits_{j = 0}^{\mu^{({\tau,\kappa,1})} - 1}\; {\delta_{j}^{({\tau,\kappa,1})} \cdot b_{0,j}^{({\tau,\kappa})}}}},\mspace{20mu} {{{for}\mspace{14mu} i} = 1},\ldots \mspace{14mu},L,{\xi_{i,\tau,\iota}\overset{U}{arrow}{_{q}( {{i = 1},\ldots \mspace{14mu},{L;{\tau = 1}},\ldots \mspace{14mu},{{m - 1};{\iota = 0}},1} )}},\mspace{20mu} {\xi_{i,\tau,\iota}:={- {\sum\limits_{\tau = 1}^{m - 1}\; {\xi_{i,\tau,\iota}( {{i = 1},\ldots \mspace{14mu},{L;{\tau = 0}},1} )}}}},\mspace{20mu} {s_{i}^{({\tau,\kappa,0})}:={{\sum\limits_{j = 0}^{\mu^{({\tau,\kappa,0})} - 1}\; {\delta_{j}^{({\tau,\kappa,0})} \cdot a_{i,j}^{({\tau,\kappa})}}} + \xi_{i,\tau,0}}},\mspace{20mu} {s_{i}^{({\tau,\kappa,1})}:={{\sum\limits_{j = 0}^{\mu^{({\tau,\kappa,1})} - 1}\; {\delta_{j}^{({\tau,\kappa,1})} \cdot b_{i,j}^{({\tau,\kappa})}}} + \xi_{i,\tau,1}}}}}} & \lbrack {{Formula}\mspace{14mu} 131} \rbrack\end{matrix}$

(S205: Key Element Generation Step)

With the processing device, concerning each integer τ of τ=1, . . . , m,each integer κ of κ=0, . . . , f_(τ), and each integer ι of ι=0, 1, thekey element generation part 142 generates an element k*₀ ^((τ,κ,ι)) ofthe decryption key sk_(s), as indicated in Formula 132.

$\begin{matrix}{\mspace{79mu} {{{\overset{arrow}{\eta}}_{0}^{({\tau,\kappa,\iota})}\overset{U}{}_{q}^{w_{0}}},{k_{0}^{*{({\tau,\kappa,\iota})}}:={\begin{pmatrix}{\overset{\overset{n_{0}}{}}{{s_{0}^{({\tau,\kappa,\iota})} + \pi_{\tau,\kappa,\iota}},{\overset{arrow}{e}}_{0}^{({\tau,\kappa,\iota})}},} \\{\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0},\overset{\overset{w_{0}}{}}{{\overset{arrow}{\eta}}_{0}^{({\tau,\kappa,\iota})}},\overset{\overset{z_{0}}{}}{0,\ldots \mspace{14mu},0,\chi_{\tau,\kappa,\iota}}}\end{pmatrix}_{0}^{*}}}}} & \lbrack {{Formula}\mspace{14mu} 132} \rbrack\end{matrix}$

As described above, for the bases B and B* indicated in Formula 113,Formula 114 is established. Hence, Formula 132 means that: s₀^((τ,κ,ι))+π_(τ,κ,ι) is set as the coefficient for a basis vectorb*_(0,1) of a basis B*₀; e^(→) ₀ ^((τ,κ,ι)) is set as the coefficientfor basis vectors b*_(0,1+1), . . . , b*_(0,1+n0) of the basis B*₀; 0 isset as the coefficient for basis vectors b*_(0,n0+1), . . . ,b*_(0,n0+,u0) of the basis B*₀; η_(0,1) ^((τ,κ,ι)), . . . , η_(0,w0)^((τ,κ,ι)) are each set as the coefficient for basis vectorsb*_(0,n0+u0+1), . . . , b*_(0,n0+u0+w0) of the basis B*₀; and 0 is setas the coefficient for basis vectors b*_(0,n0+u0+w0+1), . . . ,b*_(0,n0+u0+w0+z0) of the basis B*₀. Note that n0, u0, w0, and z0respectively represent n₀, u₀, w₀, and z₀.

Also, e^(→) ₀ ^((τ,κ,ι)) is a 2mf_(max)-dimensional vector in which 1 isset as the coefficient for one basis vector and 0 is set as thecoefficient for another basis vector, and the basis vector for which 1is set as the coefficient differs for each (τ,κ,ι). Likewise, e^(→) _(i)^((τ,κ,ι)) is a 2mf_(max)k_(max)-dimensional vector in which 1 is set asthe coefficient for one basis vector and 0 is set as the coefficient foranother basis vector, and the basis vector for which 1 is set as thecoefficient differs for each (τ,κ,ι).

Also, e^(→) ₁ is an n-dimensional vector in which 1 is set as thecoefficient for the basis vector b*_(t,1) and 0 is set as thecoefficient for another basis vector.

With the processing device, concerning each integer τ of τ=1, . . . , m,each integer κ of κ=0, . . . , f_(τ), each integer ι of ι=0, 1, and eachinteger i of i=1, . . . , L, the key element generation part 142generates an element k*_(i) ^((τ,κ,ι)) of the decryption key sk_(s), asindicated in Formula 133.

$\begin{matrix}{{{{if}\mspace{14mu} {\rho (i)}} = ( {t,{\overset{arrow}{v}}_{i}} )},\mspace{14mu} {\theta_{i}\overset{U}{}_{q}},{{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{w_{t}}},{k_{i}^{*{({\tau,\kappa,\iota})}}:={\begin{pmatrix}{\overset{\overset{n_{t}}{}}{{{s_{i}^{({\tau,\kappa,\iota})}{\overset{arrow}{e}}_{1}} + {\theta_{i}{\overset{arrow}{v}}_{i}}},{\overset{arrow}{e}}_{i}^{({\tau,\kappa,\iota})}},} \\{\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0},\overset{\overset{w_{t}}{}}{{\overset{arrow}{\eta}}_{i}},\overset{\overset{z_{t}}{}}{0,\ldots \mspace{14mu},0}}\end{pmatrix}_{t}^{*}}},{{{if}\mspace{14mu} {\rho (i)}} = {( {t,{\overset{arrow}{v}}_{i}} )}},\mspace{14mu} {{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{w_{t}}},{k_{i}^{*{({\tau,\kappa,\iota})}}:={\begin{pmatrix}{\overset{\overset{n_{t}}{}}{{s_{i}^{({\tau,\kappa,\iota})}{\overset{arrow}{v}}_{i}},{\overset{arrow}{e}}_{i}^{({\tau,\kappa,\iota})}},} \\{\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0},\overset{\overset{w_{t}}{}}{{\overset{arrow}{\eta}}_{i}},\overset{\overset{z_{t}}{}}{0,\ldots \mspace{14mu},0}}\end{pmatrix}_{t}^{*}}},{{{if}\mspace{14mu} {\rho (i)}} = p_{0}},\mspace{14mu} {{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{w_{0}}},{k_{i}^{*{({\tau,\kappa,\iota})}}:={\begin{pmatrix}{\overset{\overset{n_{0}}{}}{s_{i}^{({\tau,\kappa,\iota})},{\overset{arrow}{e}}_{0}^{({\tau,\kappa,\iota})}},} \\{\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0},\overset{\overset{w_{0}}{}}{{\overset{arrow}{\eta}}_{i}},\overset{\overset{z_{0}}{}}{0,\ldots \mspace{14mu},0}}\end{pmatrix}_{0}^{*}}}} & \lbrack {{Formula}\mspace{14mu} 133} \rbrack\end{matrix}$

(S206: Key Distribution Step)

For example, with the communication device, the key distribution part150 distributes the decryption key sk_(S), constituted as elements bythe access structure S inputted in (S201) and k*₀ ^((τ,κ,ι)), k*₁^((τ,κ,ι)), . . . , k*_(L) ^((τ,κ,ι)), generated in (S205), to thedecryption device 300 in secrecy via the network. As a matter of course,the decryption key sk_(S) may be distributed to the decryption device300 by another method.

In brief, from (S201) through (S205), the key generation device 100generates the decryption key sk_(S) by executing the KeyGen algorithmindicated in Formulas 134 to 135. Then, in (S206), the key generationdevice 100 distributes the generated decryption key sk_(S) to thedecryption device 300.

$\begin{matrix}{{KeyGen}( {{pk},{sk},{\mspace{20mu} {\pi_{\tau}\overset{U}{}_{q}}},( {{\tau = 1},\ldots \mspace{14mu},{m - 1}} ),{\pi_{m}:={- {\sum\limits_{\tau = 1}^{m - 1}\; \pi_{\tau}}}},\mspace{20mu} {\pi_{\tau,\kappa,0}\overset{U}{}_{q}},} } & \lbrack {{Formula}\mspace{14mu} 134} \rbrack \\{{\pi_{\tau,\kappa,1}:={\pi_{\tau} - {\pi_{\tau,\kappa,0}( {{\tau = 1},\ldots \mspace{14mu},{m;{\kappa = 0}},\ldots \mspace{14mu},f_{\tau}} )}}},\; {\chi_{\tau}\overset{U}{}_{q}},( {{\tau = 1},\ldots \mspace{14mu},{m - 1}} ),{\chi_{m}:={1 - {\sum\limits_{\tau = 1}^{m - 1}\; \chi_{\tau}}}},\mspace{20mu} {\chi_{\tau,\kappa,0}\overset{U}{}_{q}},} & \; \\{{\chi_{\tau,\kappa,1}:={\chi_{\tau} - {\chi_{\tau,\kappa,0}( {{\tau = 1},\ldots \mspace{14mu},{m;{\kappa = 0}},\ldots \mspace{14mu},f_{\tau}} )}}},\mspace{20mu} {{{for}\mspace{14mu} \tau} = 1},\ldots \mspace{14mu},m,{\kappa = 0},\ldots \mspace{14mu},f_{\tau},{\iota = 0},1,\mspace{20mu} {\mu^{({\tau,\kappa,0})}:={\deg ( {d_{\tau}(x)}^{\kappa} )}},\mspace{20mu} {\mu^{({\tau,\kappa,1})}:={\deg ( {d_{\tau}(x)}^{f_{\tau} - \kappa} )}},( {{\kappa = 0},\ldots \mspace{14mu},f_{\tau}} ),{{a_{i,0}^{({\tau,\kappa})} + {a_{i,1}^{({\tau,\kappa})}x} + \ldots + {a_{i,{\mu^{({\tau,\kappa,0})} - 1}}^{({\tau,\kappa})}x^{\mu^{({\tau,\kappa,0})} - 1}}}:={{a_{i}(x)}{mod}\mspace{14mu} {d_{\tau}(x)}^{\kappa}}},{{b_{i,0}^{({\tau,\kappa})} + {b_{i,1}^{({\tau,\kappa})}x} + \ldots + {b_{i,{\mu^{({\tau,\kappa,1})} - 1}}^{({\tau,\kappa})}x^{\mu^{({\tau,\kappa,1})} - 1}}}:={{b_{i}(x)}{mod}\mspace{14mu} {d_{\tau}(x)}^{f_{\tau} - \kappa}}},} & \; \\{{\delta_{j}^{({\tau,\kappa,\iota})}\overset{U}{}_{q}},( {{j = 0},\ldots \mspace{14mu},{\mu^{({\tau,\kappa,\iota})} - 1}} ),{{\overset{arrow}{\eta}}_{0}^{({\tau,\kappa,\iota})}\overset{U}{}_{q}^{w_{0}}},\mspace{20mu} {s_{0}^{,{({\tau,\kappa,0})}}:={\sum\limits_{j = 0}^{\mu^{({\tau,\kappa,0})} - 1}\; {\delta_{j}^{({\tau,\kappa,0})} \cdot a_{0,j}^{({\tau,\kappa})}}}},\mspace{20mu} {s_{0}^{,{({\tau,\kappa,1})}}:={\sum\limits_{j = 0}^{\mu^{({\tau,\kappa,1})} - 1}\; {\delta_{j}^{({\tau,\kappa,1})} \cdot b_{0,j}^{({\tau,\kappa})}}}},} & \; \\{\mspace{79mu} {{k_{0}^{*{({\tau,\kappa,\iota})}}:={\begin{pmatrix}{\overset{\overset{n_{0}}{}}{{s_{0}^{({\tau,\kappa,\iota})} + \pi_{\tau,\kappa,\iota}},{\overset{arrow}{e}}_{0}^{({\tau,\kappa,\iota})}},} \\{\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0},\overset{\overset{w_{0}}{}}{{\overset{arrow}{\eta}}_{0}^{({\tau,\kappa,\iota})}},\overset{\overset{z_{0}}{}}{0,\ldots \mspace{14mu},0,\chi_{\tau,\kappa,\iota}}}\end{pmatrix}_{0}^{*}}}\mspace{20mu} {{{{for}\mspace{14mu} i} = 1},\ldots \mspace{14mu},L,{\xi_{i,\tau,\iota}\overset{U}{}{_{q}( {{i = 1},\ldots \mspace{14mu},{L;{\tau = 1}},\ldots \mspace{14mu},{{m - 1};{\iota = 0}},1} )}},\mspace{20mu} {\xi_{i,m,\iota}:={- {\sum\limits_{\tau = 1}^{m - 1}\; {\xi_{i,\tau,\iota}( {{i = 1},\ldots \mspace{14mu},{L;{\iota = 0}},1} )}}}},\mspace{20mu} {s_{i}^{({\tau,\kappa,0})}:={{\sum\limits_{j = 1}^{\mu^{({\tau,\kappa,0})} - 1}\; {\delta_{j}^{({\tau,\kappa,0})} \cdot a_{i,j}^{({\tau,\kappa})}}} + \xi_{i,\tau,0}}},\mspace{20mu} {s_{i}^{({\tau,\kappa,1})}:={{\sum\limits_{j = 0}^{\mu^{({\tau,\kappa,1})} - 1}\; {\delta_{j}^{({\tau,\kappa,1})} \cdot b_{i,j}^{({\tau,\kappa})}}} + \xi_{i,\tau,1}}},}}} & \lbrack {{Formula}\mspace{14mu} 135} \rbrack \\{\mspace{20mu} {{{{if}\mspace{14mu} {\rho (i)}} = ( {t,{\overset{arrow}{v}}_{i}} )},{\theta_{i}\overset{U}{}_{q}},{{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{w_{i}}},\mspace{20mu} {k_{i}^{*{({\tau,\kappa,\iota})}}:={\begin{pmatrix}{\overset{\overset{n_{t}}{}}{{{s_{i}^{({\tau,\kappa,\iota})}{\overset{arrow}{e}}_{1}} + {\theta_{i}{\overset{arrow}{v}}_{i}}},{\overset{arrow}{e}}_{i}^{({\tau,\kappa,\iota})}},} \\{\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0},\overset{\overset{w_{t}}{}}{{\overset{arrow}{\eta}}_{i}},\overset{\overset{z_{t}}{}}{0,\ldots \mspace{14mu},0}}\end{pmatrix}_{t}^{*}}},\mspace{20mu} {{{if}\mspace{14mu} {\rho (i)}} = {( {t,{\overset{arrow}{v}}_{i}} )}},{{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{w_{t}}},\mspace{20mu} {k_{i}^{*{({\tau,\kappa,\iota})}}:={\begin{pmatrix}{\overset{\overset{n_{t}}{}}{{s_{i}^{({\tau,\kappa,\iota})}{\overset{arrow}{v}}_{i}},{\overset{arrow}{e}}_{i}^{({\tau,\kappa,\iota})}},} \\{\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0},\overset{\overset{w_{t}}{}}{{\overset{arrow}{\eta}}_{i}},\overset{\overset{z_{t}}{}}{0,\ldots \mspace{14mu},0}}\end{pmatrix}_{t}^{*}}},\mspace{20mu} {{{if}\mspace{14mu} {\rho (i)}} = p_{0}},{{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{w_{0}}},\mspace{20mu} {k_{i}^{*{({\tau,\kappa,\iota})}}:={\begin{pmatrix}{\overset{\overset{n_{0}}{}}{s_{i}^{({\tau,\kappa,\iota})},{\overset{arrow}{e}}_{0}^{({\tau,\kappa,\iota})}},} \\{\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0},\overset{\overset{w_{0}}{}}{{\overset{arrow}{\eta}}_{i}},\overset{\overset{z_{0}}{}}{0,\ldots \mspace{14mu},0}}\end{pmatrix}_{0}^{*}}}}} & \; \\{{{return}\mspace{14mu} {sk}_{}}:={\begin{pmatrix}{,} \\\{ {k_{0}^{*{({\tau,\kappa,\iota})}},k_{1}^{*{({\tau,\kappa,\iota})}},\ldots \mspace{14mu},k_{L}^{*{({\tau,\kappa,\iota})}},} \}_{{\tau = 1},\ldots \mspace{14mu},{m;{\kappa = 0}},\ldots \mspace{14mu},{f_{\tau};{\iota = 0}},1}\end{pmatrix}.}} & \;\end{matrix}$

The function and operation of the encryption device 200 will bedescribed.

The encryption device 200 is provided with a public parameteracquisition part 210, an information input part 220, an encrypted datageneration part 230, and a data transmission part 240.

The process of the Enc algorithm will be described with reference toFIG. 10.

(S301: Public Parameter Acquisition Step)

For example, with the communication device, the public parameteracquisition part 210 acquires the public parameters pk generated by thekey generation device 100, via the network

(S302: Information Input Step)

With the input device, the information input part 220 takes as input themessage msg to be transmitted to the decryption device 300. Also, withthe input device, the information input part 220 takes as input theattribute set Γ:={(t, x^(→) _(τ):=(x_(t,1), . . . , x_(t,n)εF_(q)^(n)))|1≦t≦d}. Note that t need not be all of the integers t fallingwithin the range of 1≦t≦d, but may be one or more of integers t fallingwithin the range of 1≦t≦d. Also, for example, decryptable user attributeinformation is set in the attribute set Γ.

(S303: Cipher Element Generation Step)

With the processing device, the encrypted data generation part 230generates an element c₀ of the ciphertext ct_(Γ), as indicated inFormula 136.

$\begin{matrix}{\omega,{\zeta \overset{U}{}_{q}},{{\overset{arrow}{\phi}}_{0}\overset{U}{}_{q}^{z_{0} - 1}},{c_{0}:={( {\overset{\overset{n_{0}}{}}{\omega,0,\ldots \mspace{14mu},0,}\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{z_{0}}{}}{{\overset{arrow}{\phi}}_{0},\zeta}} )_{0}}}} & \lbrack {{Formula}\mspace{14mu} 136} \rbrack\end{matrix}$

With the processing device, concerning each integer t included in theattribute information Γ, the encrypted data generation part 230generates an element c_(t) of the ciphertext ct_(Γ), as indicated inFormula 137.

$\begin{matrix}{\mspace{79mu} {{{{{\overset{arrow}{\phi}}_{t}\overset{U}{}_{q}^{z_{t}}}\mspace{14mu} {for}\mspace{14mu} ( {t,{\overset{arrow}{x}}_{t}} )} \in \Gamma},{c_{t}:={( {\overset{\overset{n_{t}}{}}{{\omega {\overset{arrow}{x}}_{t}},0,\ldots \mspace{14mu},0}\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{t}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{z_{t}}{}}{{\overset{arrow}{\phi}}_{t}}} ){_{t}.}}}}} & \lbrack {{Formula}\mspace{14mu} 137} \rbrack\end{matrix}$

With the processing device, the encrypted data generation part 230generates an element c_(d+1) of the ciphertext ct_(Γ), as indicated inFormula 138.

c _(d+1) :=g _(T) ^(ζ) msg  [Formula 138]

(S304: Data Transmission Step)

For example, with the communication device, the data transmission part240 transmits the ciphertext ct_(Γ), constituted as elements by theattribute set Γ inputted in (S302) and c₀, c_(t), and c_(d+1) generatedin (S303), to the decryption device 300 via the network. As a matter ofcourse, the ciphertext ct_(Γ) may be transmitted to the decryptiondevice 300 by another method.

In brief, from (S301) through (S303), the encryption device 200generates the ciphertext ct_(Γ) by executing the Enc algorithm indicatedin Formula 139. Then, in (S304), the encryption device 200 transmits thegenerated ciphertext ct_(Γ) to the decryption device 300.

$\begin{matrix}{\mspace{79mu} {{{{Enc}( {{pk},{msg},{\Gamma:=\{ ( {t,{\overset{arrow}{x}}_{t}} ) \middle| {1 \leq t \leq d} \}}} )}\text{:}}\mspace{20mu} {\omega,{\zeta \overset{U}{}_{q}},\mspace{20mu} {{\overset{arrow}{\phi}}_{0}\overset{U}{}_{q}^{z_{0} - 1}},\mspace{20mu} {{{{\overset{arrow}{\phi}}_{t}\overset{U}{}_{q}^{z_{t}}}\mspace{14mu} {for}\mspace{14mu} ( {t,{\overset{arrow}{x}}_{t}} )} \in \Gamma},{c_{0}:={( {\overset{\overset{n_{0}}{}}{\omega,0,\ldots \mspace{14mu},0,}\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{z_{0}}{}}{{\overset{arrow}{\phi}}_{0},\zeta}} )_{0}}},{c_{t}:={( {\overset{\overset{n_{t}}{}}{{\omega {\overset{arrow}{x}}_{t}},0,\ldots \mspace{14mu},0}\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{t}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{z_{t}}{}}{{\overset{arrow}{\phi}}_{t}}} )_{t}}},{{{for}\mspace{14mu} ( {t,{\overset{arrow}{x}}_{t}} )} \in \Gamma},\mspace{20mu} {c_{d + 1}:={g_{T}^{\zeta}{msg}}},\mspace{20mu} {{{return}\mspace{14mu} {ct}_{\Gamma}}:={( {\Gamma,c_{0},{\{ c_{t} \}_{{{({t,{\overset{arrow}{x}}_{t}})} \in \Gamma},}c_{d + 1}}} ).}}}}} & \lbrack {{Formula}\mspace{14mu} 139} \rbrack\end{matrix}$

The function and operation of the decryption device 300 will bedescribed.

The decryption device 300 is provided with an information acquisitionpart 310, a span program calculation part 320, a complementarycoefficient calculation part 330, and a decryption part 340. Theinformation acquisition part 310 is provided with a decryption keyacquisition part 311 and a ciphertext acquisition part 312. Thecomplementary coefficient calculation part 330 is provided with apolynomial selection part 331 and a coefficient calculation part 332.The decryption part 340 is provided with a pairing operation part 341and a message calculation part 342.

The process of the Dec algorithm will be described with reference toFIG. 11.

(S401: Decryption key Acquisition Step)

For example, with the communication device, the decryption keyacquisition part 311 acquires the decryption key sk_(S):=(S, k*₀^((τ,κ,ι)), k*₁ ^((τ,κ,ι)), . . . , k*_(L) ^((τ,κ,ι))) distributed bythe key generation device 100, via the network. The decryption keyacquisition part 311 also acquires the public parameters pk generated bythe key generation device 100.

(S402: Ciphertext Acquisition Step)

For example, with the communication device, the ciphertext acquisitionpart 312 acquires the ciphertext ct_(Γ):=(Γ, c₀, c_(t), c_(d+1))transmitted by the encryption device 200, via the network.

(S403: Span Program Calculation Step)

With the processing device, the span program calculation part 320 checkswhether or not the access structure S included in the decryption keysk_(S) acquired in (S401) accepts Γ included in the ciphertext ct_(Γ)acquired in (S402). The method of checking whether or not the accessstructure S accepts r is the same as that described in “2-1. QuadraticSpan Program in Embodiment 1”.

The span program calculation part 320 advances to the process of (S404)if the access structure S accepts Γ (accept in S403). If the accessstructure S rejects Γ (reject in S403), the span program calculationpart 320 judges that the ciphertext ct_(Γ) cannot be decrypted, and endsthe process.

(S404: Polynomial Selection Step)

With the processing device, the polynomial selection part 331 of thecomplementary coefficient calculation part 330 calculates I_((ρ,Γ)) ⊂{1,. . . , L}. The method of calculating I_((ρ,Γ)) is the same as thatdescribed in “2-2. Inner-Product of Attributes and Quadratic SpanProgram in Embodiment 1”.

(S405: Coefficient Calculation Step)

With the processing device, the coefficient calculation part 332 of thecomplementary coefficient calculation part 330 calculates coefficients(α₁, . . . , α_(L)), coefficients (β₁, . . . , β_(L)), and degrees (κ₁,. . . , κ_(m)) with which Formula 140 is established. The coefficients(α_(i), . . . , α_(L)), coefficients (β₁, . . . , β_(L)), and degrees(κ₁, . . . , κ_(m)) may be calculated by any method, for example, byround-robin.

Π_(τ=1) ^(m) d _(τ)(x)^(κ) ^(τ) |(a ₀(x)+Σ_(i=1) ^(L)α_(i) a _(i)(x)),and

Π_(τ=1) ^(m) d _(τ)(x)^(ƒτ-κ) ^(τ) |(b ₀(x)+Σ_(i=1) ^(L)β_(i) b_(i)(x))  [Formula 140]

Note that α_(i)=0=β_(i) concerning all i not included in I_((ρ,Γ)).

(S406: Pairing Operation Step)

The pairing operation part 341 of the decryption part 340 generatessession keys K_(τ,0) and K_(τ,1) by calculating Formula 141 with theprocessing device.

$\begin{matrix}{{{K_{\tau,0}:={{e( {c_{0}k_{0}^{*{({\tau,\kappa_{\tau},0})}}} )} \cdot {\prod\limits_{i \in \mathcal{I}_{{({\rho,\Gamma})},0}}\; {{e( {c_{0},k_{i}^{*{({\tau,\kappa_{\tau},0})}}} )}{\alpha_{i} \cdot {\prod\limits_{i \in \mathcal{I}_{{({\rho,\Gamma})}, +}}\; {{e( {c_{t},k_{i}^{*{({\tau,\kappa_{\tau},0})}}} )}{\alpha_{i} \cdot {\prod\limits_{i \in \mathcal{I}_{{({\rho,\Gamma})}, -}}\; {{e( {c_{t},k_{i}^{*{({\tau,\kappa_{\tau},0})}}} )}{\alpha_{i}/( {{\overset{arrow}{v}}_{i} \cdot {\overset{arrow}{x}}_{i}} )}}}}}}}}}}},{K_{\tau,1}:={{e( {c_{0}k_{0}^{*{({\tau,\kappa_{\tau},1})}}} )} \cdot {\prod\limits_{i \in \mathcal{I}_{{({\rho,\Gamma})},0}}\; {{e( {c_{0},k_{i}^{*{({\tau,\kappa_{\tau},1})}}} )}{\beta_{i} \cdot {\prod\limits_{i \in \mathcal{I}_{{({\rho,\Gamma})}, +}}\; {{e( {c_{t},k_{i}^{*{({\tau,\kappa_{\tau},1})}}} )}{\beta_{i} \cdot {\prod\limits_{i \in \mathcal{I}_{{({\rho,\Gamma})}, -}}\; {{e( {c_{t},k_{i}^{*{({\tau,\kappa_{\tau},1})}}} )}{\beta_{i}/( {{\overset{arrow}{v}}_{i} \cdot {\overset{arrow}{x}}_{i}} )}}}}}}}}}}},\mspace{20mu} {{{where}\mspace{14mu} \mathcal{I}_{{({\rho,\Gamma})},0}}:=\{ { {i \in \mathcal{I}_{({\rho,\Gamma})}} \middle| {\rho (i)}  = p_{0}} \}},\mspace{20mu} {\mathcal{I}_{{({\rho,\Gamma})}, +}:={\{ { {i \in \mathcal{I}_{({\rho,\Gamma})}} \middle| {\rho (i)}  = ( {t,{\overset{\_}{v}}_{i}} )} \} \mspace{14mu} {and}}}}\mspace{20mu} {\mathcal{I}_{{({\rho,\Gamma})}, -}:=\{ { {i \in \mathcal{I}_{({\rho,\Gamma})}} \middle| {\rho (i)}  = {( {t,{\overset{\_}{v}}_{i}} )}} \}}} & \lbrack {{Formula}\mspace{14mu} 141} \rbrack\end{matrix}$

(S407: Message Calculation Step)

The message calculation part 342 of the decryption part 340 generates amessage msg′ (=msg) by calculating Formula 142 with the processingdevice.

$\begin{matrix}{{msg}^{\prime}:={c_{d + 1}/( {\prod\limits_{\tau = 1}^{m}\; {K_{\tau,0}K_{\tau,1}}} )}} & \lbrack {{Formula}\mspace{14mu} 142} \rbrack\end{matrix}$

Note that by calculating Formula 141, g_(T) ^(ζ) can be obtained, asindicated in Formula 143. Hence, by calculating Formula 142, the messagemsg′ (=msg) m can be obtained.

$\begin{matrix}{\begin{matrix}{K_{\tau,0}:={e{( {c_{0}k_{0}^{*{({\tau,\kappa_{\tau},0})}}} ) \cdot {\prod\limits_{i \in \mathcal{I}_{{({\rho,\Gamma})},0}}\; {{e( {c_{0},k_{i}^{*{({\tau,\kappa_{\tau},0})}}} )}{\alpha_{i} \cdot}}}}}} \\{{\prod\limits_{i \in \mathcal{I}_{{({\rho,\Gamma})}, +}}\; {{e( {c_{t},k_{i}^{*{({\tau,\kappa_{\tau},0})}}} )}{\alpha_{i} \cdot}}}} \\{{{\prod\limits_{i \in \mathcal{I}_{{({\rho,\Gamma})}, -}}\; {e( {c_{t},k_{i}^{*{({\tau,\kappa_{\tau},0})}}} ){\alpha_{i}/( {{\overset{arrow}{v}}_{i} \cdot {\overset{arrow}{x}}_{i}} )}}},}} \\{= {g_{T}^{{\omega {({{\sum\limits_{j = 0}^{\mu^{({\tau,\kappa_{\tau},0})} - 1}\; {\delta_{j}^{({\tau,\kappa_{\tau},0})}a_{0,j}^{({\tau,\kappa_{\tau}})}}} + \pi_{\tau,\kappa_{\tau},0}})}} + {\zeta\chi}_{\tau,\kappa_{\tau},0}} \cdot}} \\{g_{T}^{{\omega {({{\sum\limits_{i = 1}^{L}\; {\alpha_{i}{\sum\limits_{j = 0}^{\mu^{({\tau,\kappa_{\tau},0})} - 1}\; {\delta_{j}^{({\tau,\kappa_{\tau},0})}a_{i,j}^{({\tau,\kappa_{\tau}})}}}}} + \xi_{i,\tau,0}})}})}} \\{= {g_{T}^{{\omega {({{\sum\limits_{j = 0}^{\mu^{({\tau,\kappa_{\tau},0})} - 1}\; {\delta_{j}^{({\tau,\kappa_{\tau},0})}a_{0,j}^{({\tau,\kappa_{\tau}})}}} + \pi_{\tau,\kappa_{\tau},0}})}} + {\zeta\chi}_{\tau,\kappa_{\tau},0}} \cdot}} \\{g_{T}^{\omega {({{\sum\limits_{j = 0}^{\mu^{({\tau,\kappa_{\tau},0})} - 1}\; {\delta_{j}^{({\tau,\kappa_{\tau},0})}{\sum\limits_{i = 1}^{L}\; {\alpha_{i}a_{i,j}^{({\tau,\kappa_{\tau}})}}}}} + {\alpha_{i}\xi_{i,\tau,0}}})}}} \\{= {g_{T}^{\omega({\sum\limits_{j = 0}^{\mu^{({\tau,\kappa_{\tau},0})} - 1}\; {\delta_{j}^{({\tau,\kappa_{\tau},0})}{({a_{0,j}^{({\tau,\kappa_{\tau}})} + {\sum\limits_{i = 1}^{L}\; {\alpha_{i}a_{i,j}^{({\tau,\kappa_{\tau}})}}}})}}}} \cdot}} \\{g_{T}^{{\omega\pi}_{\tau,\kappa_{\tau},0} + {\zeta\chi}_{\tau,\kappa_{\tau},0} + {\omega {\sum\limits_{i = 1}^{L}\; {\alpha_{i}\xi_{i,\tau,0}}}}}} \\{= g_{T}^{{\omega\pi}_{\tau,\kappa_{\tau},0} + {\zeta\chi}_{\tau,\kappa_{\tau},0} + {\omega {\sum\limits_{i = 1}^{L}\; {\alpha_{i}\xi_{i,\tau,0}}}}}}\end{matrix}\mspace{20mu} {K_{\tau,1} = g_{T}^{{\omega\pi}_{\tau,\kappa_{\tau},1} + {\zeta\chi}_{\tau,\kappa_{\tau},1} + {\omega {\sum\limits_{i = 1}^{L}\; {\beta_{i}\xi_{i,\tau,1}}}}}}\begin{matrix}{{\prod\limits_{\tau = 1}^{m}\; {K_{\tau,0}K_{\tau,1}}} = g_{T}^{\sum\limits_{\tau = 1}^{m}\; {({{\omega {({\pi_{\tau,\kappa_{\tau},0} + \pi_{\tau,\kappa_{\tau},1}})}} + {\zeta {({\chi_{\tau,\kappa_{\tau},0} + \chi_{\tau,\kappa_{\tau},1}})}} + {\omega {\sum\limits_{i = 1}^{L}\; {({{\alpha_{i}\xi_{i,\tau,0}} + {\beta_{i}\xi_{i,\tau,1}}})}}}})}}} \\{= g_{T}^{\omega({{\sum\limits_{\tau = 1}^{m}\; \pi_{\tau}} + {\zeta {\sum\limits_{\tau = 1}^{m}\; \chi_{\tau}}} + {\omega {\sum\limits_{i = 1}^{L}\; {\alpha_{i}{({\sum\limits_{\tau = 1}^{m}\; \xi_{i,\tau,0}})}}}} + {\omega {\sum\limits_{i = 1}^{L}\; {\beta_{i}{({\sum\limits_{\tau = 1}^{m}\; \xi_{i,\tau,1}})}}}}}}} \\{= g_{T}^{\zeta}}\end{matrix}} & \lbrack {{Formula}\mspace{14mu} 143} \rbrack\end{matrix}$

In brief, from (S401) through (S407), the decryption device 300generates the message msg′ (=msg) by executing the Dec algorithmindicated in Formula 144.

$\begin{matrix}{{{{Dec}\begin{pmatrix}{{pk},{{sk}_{}:={\quad{\begin{pmatrix}{,} \\\begin{Bmatrix}{k_{0}^{*{({\tau,\kappa,\iota})}},} \\{k_{1}^{*{({\tau,\kappa,\iota})}},} \\{\ldots \mspace{14mu},} \\k_{L}^{*{({\tau,\kappa,\iota})}}\end{Bmatrix}_{{\tau = 1},\ldots \mspace{14mu},{m;{\kappa = 0}},\ldots \mspace{14mu},{f_{\tau};{\iota = 0}},1}\end{pmatrix},}}}} \\{{ct}_{\Gamma}:=( {\Gamma,c_{0},\{ c_{t} \}_{{({t,{\overset{arrow}{x}}_{t}})} \in \Gamma},c_{d + 1}} )}\end{pmatrix}}\text{:}}\mspace{20mu} {{{{If}\mspace{14mu} }:={{( {,\mathcal{B},{d(x)},\rho} )\mspace{14mu} {accepts}\mspace{14mu} \Gamma}:=\{ ( {t,{\overset{arrow}{x}}_{t}} ) \}}},\mspace{20mu} {{{then}\mspace{14mu} {compute}\mspace{14mu} \mathcal{I}_{({\rho,\Gamma})}} \subseteq \{ {1,\ldots \mspace{14mu},L} \}},( {\alpha_{1},\ldots \mspace{14mu},\alpha_{L}} ),\mspace{20mu} {{( {\beta_{1},\ldots \mspace{14mu},\beta_{L}} )\mspace{14mu} {with}\mspace{14mu} \alpha_{i}} = {0 = {{\beta_{i}\mspace{14mu} {for}\mspace{14mu} {all}\mspace{14mu} i} \notin \mathcal{I}_{({\rho,\Gamma})}}}},\mspace{20mu} {{and}\mspace{14mu} ( {\kappa_{1},\ldots \mspace{14mu},\kappa_{m}} )\mspace{14mu} {such}\mspace{14mu} {that}}}\mspace{20mu} { {\prod\limits_{\tau = 1}^{m}\; {d_{\tau}(x)}^{\kappa_{\tau}}} \middle| ( {{a_{0}(x)} + {\sum\limits_{i = 1}^{L}\; {\alpha_{i}{a_{i}(x)}}}} ) ,\mspace{20mu}  {{and}\mspace{14mu} {\prod\limits_{\tau = 1}^{m}\; {d_{\tau}(x)^{f_{\tau} - \kappa_{\tau}}}}} \middle| ( {{b_{0}(x)} + {\sum\limits_{i = 1}^{L}\; {\beta_{i}{b_{i}(x)}}}} ) ,{K_{\tau,0}:={e{( {c_{0}k_{0}^{*{({\tau,\kappa_{\tau},0})}}} ) \cdot {\prod\limits_{i \in \mathcal{I}_{{({\rho,\Gamma})},0}}\; {{e( {c_{0},k_{i}^{*{({\tau,\kappa_{\tau},0})}}} )}{\alpha_{i} \cdot {\prod\limits_{i \in \mathcal{I}_{{({\rho,\Gamma})}, +}}\; {{e( {c_{t},k_{i}^{*{({\tau,\kappa_{\tau},0})}}} )}{\alpha_{i} \cdot {\prod\limits_{i \in \mathcal{I}_{{({\rho,\Gamma})}, -}}\; {e( {c_{t},k_{i}^{*{({\tau,\kappa_{\tau},0})}}} ){\alpha_{i}/( {{\overset{arrow}{v}}_{i} \cdot {\overset{arrow}{x}}_{i}} )}}}}}}}}}}}},{K_{\tau,1}:={e{( {c_{0}k_{0}^{*{({\tau,\kappa_{\tau},1})}}} ) \cdot {\prod\limits_{i \in \mathcal{I}_{{({\rho,\Gamma})},0}}\; {{e( {c_{0},k_{i}^{*{({\tau,\kappa_{\tau},1})}}} )}{\beta_{i} \cdot {\prod\limits_{i \in \mathcal{I}_{{({\rho,\Gamma})}, +}}\; {{e( {c_{t},k_{i}^{*{({\tau,\kappa_{\tau},1})}}} )}{\beta_{i} \cdot {\prod\limits_{i \in \mathcal{I}_{{({\rho,\Gamma})}, -}}\; {e( {c_{t},k_{i}^{*{({\tau,\kappa_{\tau},1})}}} ){\beta_{i}/( {{\overset{arrow}{v}}_{i} \cdot {\overset{arrow}{x}}_{i}} )}}}}}}}}}}}},\mspace{20mu} {{{where}\mspace{14mu} \mathcal{I}_{{({\rho,\Gamma})},0}}:=\{ { {i \in \mathcal{I}_{({\rho,\Gamma})}} \middle| {\rho (i)}  = p_{0}} \}},\mspace{20mu} {\mathcal{I}_{{({\rho,\Gamma})}, +}:={\{ { {i \in \mathcal{I}_{({\rho,\Gamma})}} \middle| {\rho (i)}  = ( {t,{\overset{\_}{v}}_{i}} )} \} \mspace{14mu} {and}}}}\mspace{20mu} {\mathcal{I}_{{({\rho,\Gamma})}, -}:={{{\{ { {i \in \mathcal{I}_{({\rho,\Gamma})}} \middle| {\rho (i)}  = {( {t,{\overset{\_}{v}}_{i}} )}} \}.\mspace{20mu} {return}}\mspace{14mu} {msg}^{\prime}}:={c_{d + 1}/{( {\prod\limits_{\tau = 1}^{m}\; {K_{\tau,0}K_{\tau,1}}} ).}}}}} & \lbrack {{Formula}\mspace{14mu} 144} \rbrack\end{matrix}$

As described above, the cryptographic system 10 according to Embodiment2 implements the functional encryption scheme that utilizes thequadratic span program.

By utilizing the quadratic span program, a wider range can be expressedas the relation R.

In particular, in the cryptographic system 10 according to Embodiment 2,for each polynomial d_(τ)(x)^(fτ) obtained by factorizing the targetpolynomial d(x), an element which is a remainder of dividing apolynomial a_(i)(x) by a polynomial d_(τ)(x)^(κ) and an element which isa remainder of dividing a polynomial b_(i)(x) by a polynomiald_(τ)(x)^(fτ-κ) are treated as key elements k*₀ ^((τ,κ,ι)), k*₁^((τ,κ,ι)), . . . , k*_(L) ^((τ,κ,ι)). Also, secret information n andsecret information χ are set by sharing in each key element k*₀^((τ,κ,ι)). Using the coefficients α and β, pairing operation of the keyelements and the cipher elements is carried out to render the remainderset in each key element to 0, the secret information it to 0, and thesecret information χ to 1, thereby extracting the session keys K_(τ,0)and K_(τ,1) from the ciphertext. This implements the functionalencryption scheme that utilizes the quadratic span program.

The KP-FE scheme has been described above. If the KeyGen algorithm, Encalgorithm, and Dec algorithm are modified as indicated in Formulas 145to 148, the CP-FE scheme may be realized. Note that the Setup algorithmis the same between the KP-FE scheme and the CP-FE scheme.

$\begin{matrix}{\mspace{79mu} {{{{{KeyGen}( {{pk},{sk},{\Gamma:=\{ ( {t,{\overset{arrow}{x}}_{t}} ) \middle| {1 \leq t \leq d} \}}} )}\text{:}}\mspace{20mu} {\omega \overset{U}{}_{q}}},\mspace{20mu} {{\overset{arrow}{\phi}}_{0}\overset{U}{}_{q}^{w_{0}}},\mspace{20mu} {{{{\overset{arrow}{\phi}}_{t}\overset{U}{}_{q}^{w_{t}}}\mspace{14mu} {for}\mspace{14mu} ( {t,{\overset{arrow}{x}}_{t}} )} \in \Gamma},}} & \lbrack {{Formula}\mspace{14mu} 145} \rbrack \\{{k_{0}^{*}:={( {\overset{\overset{n_{0}}{}}{\omega,0,\ldots \mspace{14mu},0,}\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{0}}{}}{{\overset{arrow}{\phi}}_{0},}\overset{\overset{z_{0}}{}}{0,\ldots \mspace{14mu},0,1}} )_{0}^{*}}},\mspace{20mu} {k_{t}^{*}:={( {\overset{\overset{n_{t}}{}}{{\omega {\overset{arrow}{x}}_{t}},0,\ldots \mspace{14mu},0}\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{t}}{}}{{\overset{arrow}{\phi}}_{t},}\overset{\overset{z_{t}}{}}{0,\ldots \mspace{14mu},0}} )_{t}^{*}}},\mspace{20mu} {{{for}\mspace{14mu} ( {t,{\overset{arrow}{x}}_{t}} )} \in \Gamma},\mspace{20mu} {{{return}\mspace{14mu} {sk}_{\Gamma}}:={( {\Gamma,k_{0}^{*},\{ k_{t}^{*} \}_{{({t,{\overset{arrow}{x}}_{t}})} \in \Gamma}} ).}}} & \; \\{{Enc}( {{pk},{msg},{\mspace{20mu} {\pi_{\tau}\overset{U}{}_{q}}},( {{\tau = 1},\ldots \mspace{14mu},{m - 1}} ),{\pi_{m}:={- {\sum\limits_{\tau = 1}^{m - 1}\; \pi_{\tau}}}},\mspace{20mu} {\pi_{\tau,\kappa,0}\overset{U}{}_{q}},{\pi_{\tau,\kappa,1}:={\pi_{\tau} - {\pi_{\tau,\kappa,0}( {{\tau = 1},\ldots \mspace{14mu},{m;{\kappa = 0}},\ldots \mspace{14mu},f_{\tau}} )}}},\mspace{20mu} {\chi_{\tau}\overset{U}{}_{q}},( {{\tau = 1},\ldots \mspace{14mu},{m - 1}} ),{\chi_{m}:={1 - {\sum\limits_{\tau = 1}^{m - 1}\; \chi_{\tau}}}},} } & \lbrack {{Formula}\mspace{14mu} 146} \rbrack \\{\mspace{79mu} {{\chi_{\tau,\kappa,0}\overset{U}{}_{q}},{\chi_{\tau,\kappa,1}:={\chi_{\tau} - {\chi_{\tau,\kappa,0}( {{\tau = 1},\ldots \mspace{14mu},{m;{\kappa = 0}},\ldots \mspace{14mu},f_{\tau}} )}}},\mspace{20mu} {{{for}\mspace{14mu} \tau} = 1},\ldots \mspace{14mu},m,{\kappa = 0},\ldots \mspace{14mu},f_{\tau},{\iota = 0},1,\mspace{20mu} {\mu^{({\tau,\kappa,0})}:={\deg ( {d_{\tau}(x)}^{\kappa} )}},\mspace{20mu} {\mu^{({\tau,\kappa,1})}:={\deg ( {d_{\tau}(x)}^{f_{\tau} - \kappa} )}},( {{\kappa = 0},\ldots \mspace{14mu},f_{\tau}} ),}} & \; \\{{{a_{i,0}^{({\tau,\kappa})} + {a_{i,1}^{({\tau,\kappa})}x} + \ldots + {a_{i,{\mu^{({\tau,\kappa,0})} - 1}}^{({\tau,\kappa})}x^{\mu^{({\tau,\kappa,0})} - 1}}}:={{a_{i}(x)}{mod}\mspace{14mu} {d_{\tau}(x)}^{\kappa}}},{{b_{i,0}^{({\tau,\kappa})} + {b_{i,1}^{({\tau,\kappa})}x} + \ldots + {b_{i,{\mu^{({\tau,\kappa,1})} - 1}}^{({\tau,\kappa})}x^{\mu^{({\tau,\kappa,1})} - 1}}}:={{b_{i}(x)}{mod}\mspace{14mu} {d_{\tau}(x)}^{f_{\tau} - \kappa}}},\mspace{20mu} {\delta_{j}^{({\tau,\kappa,\iota})}\overset{U}{}_{q}},( {{j = 0},\ldots \mspace{14mu},{\mu^{({\tau,\kappa,\iota})} - 1}} ),\mspace{20mu} {{\overset{arrow}{\eta}}_{0}^{({\tau,\kappa,\iota})}\overset{U}{}_{q}^{z_{0} - 1}},\mspace{20mu} {s_{0}^{,{({\tau,\kappa,0})}}:={\sum\limits_{j = 0}^{\mu^{({\tau,\kappa,0})} - 1}\; {\delta_{j}^{({\tau,\kappa,0})} \cdot a_{0,j}^{({\tau,\kappa})}}}},\mspace{20mu} {s_{0}^{,{({\tau,\kappa,1})}}:={\sum\limits_{j = 0}^{\mu^{({\tau,\kappa,1})} - 1}\; {\delta_{j}^{({\tau,\kappa,1})} \cdot b_{0,j}^{({\tau,\kappa})}}}},} & \; \\{{c_{0}^{({\tau,\kappa,\iota})}:={( {\overset{\overset{n_{0}}{}}{{s_{0}^{({\tau,\kappa,\iota})} + \pi_{\tau,\kappa,\iota}},{\overset{arrow}{e}}_{0}^{({\tau,\kappa,\iota})},}\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{z_{0}}{}}{{\overset{arrow}{\eta}}_{0}^{({\tau,\kappa,\iota})},{\delta\chi}_{\tau,\kappa,\iota}}} )_{0}}},\mspace{20mu} {{{for}\mspace{14mu} i} = 1},\ldots \mspace{14mu},L,} & \lbrack {{Formula}\mspace{14mu} 147} \rbrack \\{{\xi_{i,\tau,\iota}\overset{U}{}{_{q}( {{i = 1},\ldots \mspace{14mu},{L;{\tau = 1}},\ldots \mspace{14mu},{{m - 1};{\iota = 0}},1} )}},\mspace{20mu} {\xi_{i,m,\iota}:={- {\sum\limits_{\tau = 1}^{m - 1}\; {\xi_{i,\tau,\iota}( {{i = 1},\ldots \mspace{14mu},{L;{\iota = 0}},1} )}}}},\mspace{20mu} {s_{i}^{({\tau,\kappa,0})}:={{\sum\limits_{j = 0}^{\mu^{({\tau,\kappa,0})} - 1}\; {\delta_{j}^{({\tau,\kappa,0})} \cdot a_{i,j}^{({\tau,\kappa})}}} + \xi_{i,\tau,0}}},\mspace{20mu} {s_{i}^{({\tau,\kappa,1})}:={{\sum\limits_{j = 0}^{\mu^{({\tau,\kappa,1})} - 1}\; {\delta_{j}^{({\tau,\kappa,1})} \cdot b_{i,j}^{({\tau,\kappa})}}} + \xi_{i,\tau,1}}},\mspace{20mu} {{{if}\mspace{14mu} {\rho (i)}} = ( {t,{\overset{arrow}{v}}_{i}} )},{\theta_{i}\overset{U}{}_{q}},{{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{z_{t}}},} & \; \\{{c_{i}^{({\tau,\kappa,\iota})}:={( {\overset{\overset{n_{t}}{}}{{{s_{i}^{({\tau,\kappa,\iota})}{\overset{arrow}{e}}_{1}} + {\theta_{i}{\overset{arrow}{v}}_{i}}},{\overset{arrow}{e}}_{i}^{({\tau,\kappa,\iota})},}\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{t}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{z_{t}}{}}{{\overset{arrow}{\eta}}_{i}}} )_{t}}},\mspace{20mu} {{{if}\mspace{14mu} {\rho (i)}} = {( {t,{\overset{arrow}{v}}_{i}} )}},{{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{z_{t}}},{c_{i}^{({\tau,\kappa,\iota})}:={( {\overset{\overset{n_{t}}{}}{{s_{i}^{({\tau,\kappa,\iota})}{\overset{arrow}{v}}_{i}},{\overset{arrow}{e}}_{i}^{({\tau,\kappa,\iota})},}\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{t}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{z_{t}}{}}{{\overset{arrow}{\eta}}_{i}}} )_{t}}},\mspace{20mu} {{{if}\mspace{14mu} {\rho (i)}} = p_{0}},{{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{z_{0}}},{c_{i}^{({\tau,\kappa,\iota})}:={( {\overset{\overset{n_{0}}{}}{s_{i}^{({\tau,\kappa,\iota})},{\overset{arrow}{e}}_{0}^{({\tau,\kappa,\iota})},}\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{z_{0}}{}}{{\overset{arrow}{\eta}}_{i}}} )_{0}}},\mspace{20mu} {c_{d + 1}:={g_{T}^{\zeta}{msg}}},} & \; \\{{{return}\mspace{14mu} {ct}_{}}:={\begin{pmatrix}{,} \\{\{ {c_{0}^{({\tau,\kappa,\iota})},c_{1}^{({\tau,\kappa,\iota})},\ldots \mspace{14mu},c_{L}^{({\tau,\kappa,\iota})},} \}_{{\tau = 1},\ldots \mspace{14mu},{m;{\kappa = 0}},\ldots \mspace{14mu},{f_{\tau};{\iota = 0}},1}c_{d + 1}}\end{pmatrix}.}} & \; \\{{{Dec}\begin{pmatrix}{{pk},{{sk}_{\Gamma}:=( {\Gamma,k_{0}^{*},\{ k_{t}^{*} \}_{{({t,{\overset{arrow}{x}}_{t}})} \in \Gamma}} )},} \\{{ct}_{}:=\begin{pmatrix}{,} \\{\begin{Bmatrix}{c_{0}^{({\tau,\kappa,\iota})},} \\{c_{1}^{({\tau,\kappa,\iota})},} \\{\ldots \mspace{14mu},} \\c_{L}^{({\tau,\kappa,\iota})}\end{Bmatrix}_{{\tau = 1},\ldots \mspace{14mu},{m;{\kappa = 0}},\ldots \mspace{14mu},{f_{\tau};{\iota = 0}},1},c_{d + 1}}\end{pmatrix}}\end{pmatrix}}\text{:}} & \lbrack {{Formula}\mspace{14mu} 148} \rbrack \\{\mspace{79mu} {{{{If}\mspace{14mu} }:={{( {,\mathcal{B},{d(x)},\rho} )\mspace{14mu} {accepts}\mspace{14mu} \Gamma}:=\{ ( {t,{\overset{arrow}{x}}_{t}} ) \}}},\mspace{20mu} {{{then}\mspace{14mu} {compute}\mspace{14mu} \mathcal{I}_{({\rho,\Gamma})}} \subseteq \{ {1,\ldots \mspace{14mu},L} \}},( {\alpha_{1},\ldots \mspace{14mu},\alpha_{L}} ),{{( {\beta_{1},\ldots \mspace{14mu},\beta_{L}} )\mspace{14mu} {with}\mspace{14mu} \alpha_{i}} = {0 = {{\beta_{i}\mspace{14mu} {for}\mspace{14mu} {all}\mspace{14mu} i} \notin \mathcal{I}_{({\rho,\Gamma})}}}}, {{{and}( {\kappa_{1},\ldots \mspace{14mu},\kappa_{m}} )}\mspace{11mu} {such}\mspace{14mu} {that}\mspace{14mu} {\prod\limits_{\tau = 1}^{m}\; {d_{\tau}(x)}^{\kappa_{\tau}}}} \middle| ( {{a_{0}(x)} + {\sum\limits_{i = 1}^{L}\; {\alpha_{i}{a_{i}(x)}}}} ) ,\mspace{20mu}  {{and}\mspace{14mu} {\prod\limits_{\tau = 1}^{m}\; {d_{\tau}(x)^{f_{\tau} - \kappa_{\tau}}}}} \middle| ( {{b_{0}(x)} + {\sum\limits_{i = 1}^{L}\; {\beta_{i}{b_{i}(x)}}}} ) ,}} & \; \\{{K_{\tau,0}:={{e( {k_{0}c_{0}^{*{({\tau,\kappa_{\tau},0})}}} )} \cdot {\prod\limits_{i \in \mathcal{I}_{{({\rho,\Gamma})},0}}\; {{e( {k_{0},c_{i}^{*{({\tau,\kappa_{\tau},0})}}} )}{\alpha_{i} \cdot {\prod\limits_{i \in \mathcal{I}_{{({\rho,\Gamma})}, +}}\; {{e( {k_{t},c_{i}^{*{({\tau,\kappa_{\tau},0})}}} )}{\alpha_{i} \cdot {\prod\limits_{i \in \mathcal{I}_{{({\rho,\Gamma})}, -}}\; {{e( {k_{t},c_{i}^{*{({\tau,\kappa_{\tau},0})}}} )}{\alpha_{i}/( {{\overset{arrow}{v}}_{i} \cdot {\overset{arrow}{x}}_{t}} )}}}}}}}}}}},{K_{\tau,1}:={{e( {k_{0}c_{0}^{*{({\tau,\kappa_{\tau},1})}}} )} \cdot {\prod\limits_{i \in \mathcal{I}_{{({\rho,\Gamma})},0}}\; {{e( {k_{0},c_{i}^{*{({\tau,\kappa_{\tau},1})}}} )}{\beta_{i} \cdot {\prod\limits_{i \in \mathcal{I}_{{({\rho,\Gamma})}, +}}\; {{e( {k_{t},c_{i}^{*{({\tau,\kappa_{\tau},1})}}} )}{\beta_{i} \cdot {\prod\limits_{i \in \mathcal{I}_{{({\rho,\Gamma})}, -}}\; {{e( {k_{t},c_{i}^{*{({\tau,\kappa_{\tau},1})}}} )}{\beta_{i}/( {{\overset{arrow}{v}}_{i} \cdot {\overset{arrow}{x}}_{t}} )}}}}}}}}}}},} & \; \\{\mspace{79mu} {{{{{where}\mspace{14mu} \mathcal{I}_{{({\rho,\Gamma})},0}}:=\{ { {i \in \mathcal{I}_{({\rho,\Gamma})}} \middle| {\rho (i)}  = p_{0}} \}},\mspace{20mu} {\mathcal{I}_{{({\rho,\Gamma})}, +}:={\{ { {i \in \mathcal{I}_{({\rho,\Gamma})}} \middle| {\rho (i)}  = ( {t,{\overset{\_}{v}}_{i}} )} \} \mspace{14mu} {and}}}}\mspace{20mu} {\mathcal{I}_{{({\rho,\Gamma})}, -}:={{{\{ { {i \in \mathcal{I}_{({\rho,\Gamma})}} \middle| {\rho (i)}  = {( {t,{\overset{\_}{v}}_{i}} )}} \}.\mspace{20mu} {return}}\mspace{14mu} {msg}^{\prime}}:={c_{d + 1}/{( {\prod\limits_{\tau = 1}^{m}\; {K_{\tau,0}K_{\tau,1}}} ).}}}}}} & \;\end{matrix}$

The functional encryption scheme has been described above. If the Setupalgorithm, KeyGen algorithm, Enc algorithm, and Dec algorithm aremodified as indicated in Formulas 149 to 153, an attribute-basedencryption scheme may be realized.

With the attribute-based encryption scheme, in the Setup algorithm,n_(t) is 2mf_(max)k_(max)+2.

$\begin{matrix}{\mspace{79mu} {{{{Setup}( 1^{\lambda} )}\text{:}}\mspace{20mu} {( {{param},( {_{t},_{t}^{*}} )_{{t = 0},\ldots \mspace{14mu},d}} )\overset{R}{}{_{ob}( 1^{\lambda} )}}{{{\hat{}}_{0}:=( {b_{0,1},b_{0,{n_{0} + u_{0} + w_{0} + 1}},\ldots \mspace{14mu},b_{0,{n_{0} + u_{0} + w_{0} + z_{0}}}} )},{{\hat{}}_{t}:=( {b_{t,1},b_{t,2},b_{t,{n_{t} + u_{t} + w_{t} + 1}},\ldots \mspace{14mu},b_{t,{n_{t} + u_{t} + w_{t} + z_{t}}}} )},\mspace{20mu} {{{for}\mspace{14mu} t} = 1},\ldots \mspace{14mu},d,{{\hat{}}_{0}^{*}:=( {b_{0,1}^{*},\ldots \mspace{14mu},b_{0,n_{0}}^{*},b_{0,{n_{0} + u_{0} + 1}}^{*},\ldots \mspace{14mu},b_{0,{n_{0} + u_{0} + w_{0}}}^{*},b_{0,{n_{0} + u_{0} + w_{0} + z_{0}}}^{*}} )},{{\hat{}}_{t}^{*}:=( {b_{t,1}^{*},\ldots \mspace{14mu},b_{t,n_{t}}^{*},b_{t,{n_{t} + u_{t} + 1}}^{*},\ldots \mspace{14mu},b_{t,{n_{t} + u_{t} + w_{t}}}^{*}} )}}\mspace{20mu} {{{{for}\mspace{14mu} t} = 1},\ldots \mspace{14mu},d,\mspace{20mu} {{{return}\mspace{14mu} {pk}}:=( {1^{\lambda},\{ {\hat{}}_{t} \}_{{t = 0},\ldots \mspace{14mu},d},{param}} )},\mspace{20mu} {{sk}:={\{ {\hat{}}_{t}^{*} \}_{{t = 0},\ldots \mspace{14mu},d}.}}}}} & \lbrack {{Formula}\mspace{14mu} 149} \rbrack \\{{KeyGen}( {{pk},{sk},{\mspace{20mu} {\pi_{\tau}\overset{U}{}_{q}}},( {{\tau = 1},\ldots \mspace{14mu},{m - 1}} ),{\pi_{m}:={- {\sum\limits_{\tau = 1}^{m - 1}\; \pi_{\tau}}}},\mspace{20mu} {\pi_{\tau,\kappa,0}\overset{U}{}_{q}},} } & \lbrack {{Formula}\mspace{14mu} 150} \rbrack \\{{\pi_{\tau,\kappa,1}:={\pi_{\tau} - {\pi_{\tau,\kappa,0}( {{\tau = 1},\ldots \mspace{14mu},{m;{\kappa = 0}},\ldots \mspace{14mu},f_{\tau}} )}}},\mspace{20mu} {\chi_{\tau}\overset{U}{}_{q}},( {{\tau = 1},\ldots \mspace{14mu},{m - 1}} ),{\chi_{m}:={1 - {\sum\limits_{\tau = 1}^{m - 1}\; \chi_{\tau}}}},\mspace{20mu} {\chi_{\tau,\kappa,0}\overset{U}{}_{q}},} & \; \\{{\chi_{\tau,\kappa,1}:={\chi_{\tau} - {\chi_{\tau,\kappa,0}( {{\tau = 1},\ldots \mspace{14mu},{m;{\kappa = 0}},\ldots \mspace{14mu},f_{\tau}} )}}},\mspace{20mu} {{{for}\mspace{14mu} \tau} = 1},\ldots \mspace{14mu},m,{\kappa = 0},\ldots \mspace{14mu},f_{\tau},{\iota = 0},1,\mspace{20mu} {\mu^{({\tau,\kappa,0})}:={\deg ( {d_{\tau}(x)}^{\kappa} )}},\mspace{20mu} {\mu^{({\tau,\kappa,1})}:={\deg ( {d_{\tau}(x)}^{f_{\tau} - \kappa} )}},( {{\kappa = 0},\ldots \mspace{14mu},f_{\tau}} ),} & \; \\{{{a_{i,0}^{({\tau,\kappa})} + {a_{i,1}^{({\tau,\kappa})}x} + \ldots + {a_{i,{\mu^{({\tau,\kappa,0})} - 1}}^{({\tau,\kappa})}x^{\mu^{({\tau,\kappa,0})} - 1}}}:={{a_{i}(x)}{mod}\mspace{14mu} {d_{\tau}(x)}^{\kappa}}},{{b_{i,0}^{({\tau,\kappa})} + {b_{i,1}^{({\tau,\kappa})}x} + \ldots + {b_{i,{\mu^{({\tau,\kappa,1})} - 1}}^{({\tau,\kappa})}x^{\mu^{({\tau,\kappa,1})} - 1}}}:={{b_{i}(x)}{mod}\mspace{14mu} {d_{\tau}(x)}^{f_{\tau} - \kappa}}},} & \; \\{\mspace{79mu} {{\delta_{j}^{({\tau,\kappa,\iota})}\overset{U}{}_{q}},( {{j = 0},\ldots \mspace{14mu},{\mu^{({\tau,\kappa,\iota})} - 1}} ),\mspace{20mu} {{\overset{arrow}{\eta}}_{0}^{({\tau,\kappa,\iota})}\overset{U}{}_{q}^{w_{0} - 1}},\mspace{20mu} {s_{0}^{,{({\tau,\kappa,0})}}:={\sum\limits_{j = 0}^{\mu^{({\tau,\kappa,0})} - 1}\; {\delta_{j}^{({\tau,\kappa,0})} \cdot a_{0,j}^{({\tau,\kappa})}}}},\mspace{20mu} {s_{0}^{,{({\tau,\kappa,1})}}:={\sum\limits_{j = 0}^{\mu^{({\tau,\kappa,1})} - 1}\; {\delta_{j}^{({\tau,\kappa,1})} \cdot b_{0,j}^{({\tau,\kappa})}}}},}} & \; \\{{k_{0}^{*{({\tau,\kappa,\iota})}}:={( {\overset{\overset{n_{0}}{}}{{s_{0}^{({\tau,\kappa,\iota})} + \pi_{\tau,\kappa,\iota}},{\overset{arrow}{e}}_{0}^{({\tau,\kappa,\iota})},}\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{0}}{}}{{\overset{arrow}{\eta}}_{0}^{({\tau,\kappa,\iota})}}\overset{\overset{z_{0}}{}}{,0,\ldots \mspace{14mu},0,\chi_{\tau,\kappa,\iota}}} )_{0}^{*}}},\mspace{20mu} {{{for}\mspace{14mu} i} = 1},\ldots \mspace{14mu},L,} & \lbrack {{Formula}\mspace{14mu} 151} \rbrack \\{{\xi_{i,\tau,\iota}\overset{U}{}{_{q}( {{i = 1},\ldots \mspace{14mu},{L;{\tau = 1}},\ldots \mspace{14mu},{{m - 1};{\iota = 0}},1} )}},\mspace{20mu} {\xi_{i,m,\iota}:={- {\sum\limits_{\tau = 1}^{m - 1}\; {\xi_{i,\tau,\iota}( {{i = 1},\ldots \mspace{14mu},{L;{\iota = 0}},1} )}}}},\mspace{20mu} {s_{i}^{({\tau,\kappa,0})}:={{\sum\limits_{j = 0}^{\mu^{({\tau,\kappa,0})} - 1}\; {\delta_{j}^{({\tau,\kappa,0})} \cdot a_{i,j}^{({\tau,\kappa})}}} + \xi_{i,\tau,0}}},\mspace{20mu} {s_{i}^{({\tau,\kappa,1})}:={{\sum\limits_{j = 0}^{\mu^{({\tau,\kappa,1})} - 1}\; {\delta_{j}^{({\tau,\kappa,1})} \cdot b_{i,j}^{({\tau,\kappa})}}} + \xi_{i,\tau,1}}},\mspace{20mu} {{{if}\mspace{14mu} {\rho (i)}} = ( {t,v_{i}} )},{\theta_{i}\overset{U}{}_{q}},{{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{w_{t}}},} & \; \\{{k_{i}^{*{({\tau,\kappa,\iota})}}:={( {\overset{\overset{n_{t}}{}}{{{s_{i}^{({\tau,\kappa,\iota})}{\overset{arrow}{e}}_{1}} + {\theta_{i}v_{i}}},{- \theta_{i}},{\overset{arrow}{e}}_{i}^{({\tau,\kappa,\iota})},}\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{t}}{}}{{\overset{arrow}{\eta}}_{i},}\overset{\overset{z_{t}}{}}{0,\ldots \mspace{14mu},0}} )_{t}^{*}}},\mspace{20mu} {{{if}\mspace{14mu} {\rho (i)}} = {( {t,v_{i}} )}},{{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{w_{t}}},{k_{i}^{*{({\tau,\kappa,\iota})}}:={( {\overset{\overset{n_{t}}{}}{{s_{i}^{({\tau,\kappa,\iota})}v_{i}},{{- s_{i}^{({\tau,\kappa,\iota})}}{\overset{arrow}{e}}_{i}^{({\tau,\kappa,\iota})}},}\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{t}}{}}{{\overset{arrow}{\eta}}_{i},}\overset{\overset{z_{t}}{}}{0,\ldots \mspace{14mu},0}} )_{t}^{*}}},\mspace{20mu} {{{if}\mspace{14mu} {\rho (i)}} = p_{0}},{{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{w_{0}}},{k_{i}^{*{({\tau,\kappa,\iota})}}:={( {\overset{\overset{n_{0}}{}}{s_{i}^{({\tau,\kappa,\iota})},{\overset{arrow}{e}}_{0}^{({\tau,\kappa,\iota})},}\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{0}}{}}{{\overset{arrow}{\eta}}_{i},}\overset{\overset{z_{0}}{}}{0,\ldots \mspace{14mu},0}} )_{0}^{*}}},\mspace{20mu} {c_{d + 1}:={g_{T}^{\zeta}{msg}}},} & \; \\{{{return}\mspace{14mu} {sk}_{}}:={\begin{pmatrix}{,} \\\{ {k_{0}^{*{({\tau,\kappa,\iota})}},k_{1}^{*{({\tau,\kappa,\iota})}},\ldots \mspace{14mu},k_{L}^{*{({\tau,\kappa,\iota})}},} \}_{{\tau = 1},\ldots \mspace{14mu},{m;{\kappa = 0}},\ldots \mspace{14mu},{f_{\tau};{\iota = 0}},1}\end{pmatrix}.}} & \; \\{\; {{{Enc}( {{pk},{msg},{\Gamma:=\{ ( {t,{\overset{arrow}{x}}_{t}} ) \middle| {1 \leq t \leq d} \}}} )\text{:}}\mspace{20mu} {\omega,{\zeta \overset{U}{}_{q}},\mspace{20mu} {{\overset{arrow}{\phi}}_{0}\overset{U}{}_{q}^{z_{0} - 1}},\mspace{20mu} {{{{\overset{arrow}{\phi}}_{t}\overset{U}{}_{q}^{z_{t}}}\mspace{14mu} {for}\mspace{14mu} ( {t,{\overset{arrow}{x}}_{t}} )} \in \Gamma},{c_{0}:={( {\overset{\overset{n_{0}}{}}{\omega,0,\ldots \mspace{14mu},0,}\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{z_{0}}{}}{{\overset{arrow}{\phi}}_{0},\zeta}} )_{0}}},{c_{t}:={( {\overset{\overset{n_{t}}{}}{{\omega ( {1,x_{t}} )},0,\ldots \mspace{14mu},0}\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{t}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{z_{t}}{}}{{\overset{arrow}{\phi}}_{t}}} )_{t}}},{{{for}\mspace{14mu} ( {t,x_{t}} )} \in \Gamma},\mspace{20mu} {c_{d + 1}:={g_{T}^{\zeta}{msg}}},{{ct}_{\Gamma}:=( {\Gamma,c_{0},{\{ c_{t} \}_{{{({t,x_{t}})} \in \Gamma},}c_{d + 1}}} )},\mspace{20mu} {{return}\mspace{14mu} {{ct}_{\Gamma}.}}}}} & \lbrack {{Formula}\mspace{14mu} 152} \rbrack \\{{{Dec}\begin{pmatrix}{{pk},{{sk}_{}:={\quad{\begin{pmatrix}{,} \\\begin{Bmatrix}{k_{0}^{*{({\tau,\kappa,\iota})}},} \\{k_{1}^{*{({\tau,\kappa,\iota})}},} \\{\ldots \mspace{14mu},} \\k_{L}^{*{({\tau,\kappa,\iota})}}\end{Bmatrix}_{{\tau = 1},\ldots \mspace{14mu},{m;{\kappa = 0}},\ldots \mspace{14mu},{f_{\tau};{\iota = 0}},1}\end{pmatrix},}}}} \\{{ct}_{\Gamma}:=( {\Gamma,c_{0},\{ c_{t} \}_{{({t,{\overset{arrow}{x}}_{t}})} \in \Gamma},c_{d + 1}} )}\end{pmatrix}}\text{:}} & \lbrack {{Formula}\mspace{14mu} 153} \rbrack \\{\mspace{79mu} {{{{{If}\mspace{14mu} }:={{( {,\mathcal{B},{d(x)},\rho} )\mspace{14mu} {accepts}\mspace{14mu} \Gamma}:=\{ ( {t,x_{t}} ) \}}},\mspace{20mu} {{{then}\mspace{14mu} {compute}\mspace{14mu} \mathcal{I}_{({\rho,\Gamma})}} \subseteq \{ {1,\ldots \mspace{14mu},L} \}},( {\alpha_{1},\ldots \mspace{14mu},\alpha_{L}} ),\mspace{20mu} {{( {\beta_{1},\ldots \mspace{14mu},\beta_{L}} )\mspace{14mu} {with}\mspace{14mu} \alpha_{i}} = {0 = {{\beta_{i}\mspace{14mu} {for}\mspace{14mu} {all}\mspace{14mu} i} \notin \mathcal{I}_{({\rho,\Gamma})}}}},\mspace{20mu} {{and}\mspace{14mu} ( {\kappa_{1},\ldots \mspace{14mu},\kappa_{m}} )\mspace{14mu} {such}\mspace{14mu} {that}}}\mspace{20mu} { {\prod\limits_{\tau = 1}^{m}\; {d_{\tau}(x)}^{\kappa_{\tau}}} \middle| ( {{a_{0}(x)} + {\sum\limits_{i = 1}^{L}\; {\alpha_{i}{a_{i}(x)}}}} ) ,\mspace{20mu}  {{and}\mspace{14mu} {\prod\limits_{\tau = 1}^{m}\; {d_{\tau}(x)^{f_{\tau} - \kappa_{\tau}}}}} \middle| ( {{b_{0}(x)} + {\sum\limits_{i = 1}^{L}\; {\beta_{i}{b_{i}(x)}}}} ) ,}}} & \; \\{{K_{\tau,0}:={e{( {c_{0}k_{0}^{*{({\tau,\kappa_{\tau},0})}}} ) \cdot {\prod\limits_{i \in \mathcal{I}_{{({\rho,\Gamma})},0}}\; {{e( {c_{0},k_{i}^{*{({\tau,\kappa_{\tau},0})}}} )}{\alpha_{i} \cdot {\prod\limits_{i \in \mathcal{I}_{{({\rho,\Gamma})}, +}}\; {{e( {c_{t},k_{i}^{*{({\tau,\kappa_{\tau},0})}}} )}{\alpha_{i} \cdot {\prod\limits_{i \in \mathcal{I}_{{({\rho,\Gamma})}, -}}\; {e( {c_{t},k_{i}^{*{({\tau,\kappa_{\tau},0})}}} ){\alpha_{i}/( {v_{i} \cdot x_{t}} )}}}}}}}}}}}},{K_{\tau,1}:={e{( {c_{0}k_{0}^{*{({\tau,\kappa_{\tau},1})}}} ) \cdot {\prod\limits_{i \in \mathcal{I}_{{({\rho,\Gamma})},0}}\; {{e( {c_{0},k_{i}^{*{({\tau,\kappa_{\tau},1})}}} )}{\beta_{i} \cdot {\prod\limits_{i \in \mathcal{I}_{{({\rho,\Gamma})}, +}}\; {{e( {c_{t},k_{i}^{*{({\tau,\kappa_{\tau},1})}}} )}{\beta_{i} \cdot {\prod\limits_{i \in \mathcal{I}_{{({\rho,\Gamma})}, -}}\; {e( {c_{t},k_{i}^{*{({\tau,\kappa_{\tau},1})}}} ){\beta_{i}/( {v_{i} \cdot x_{t}} )}}}}}}}}}}}},} & \; \\{\mspace{79mu} {{{{{where}\mspace{14mu} \mathcal{I}_{{({\rho,\Gamma})},0}}:=\{ { {i \in \mathcal{I}_{({\rho,\Gamma})}} \middle| {\rho (i)}  = p_{0}} \}},\mspace{20mu} {\mathcal{I}_{{({\rho,\Gamma})}, +}:={\{ { {i \in \mathcal{I}_{({\rho,\Gamma})}} \middle| {\rho (i)}  = ( {t,v_{i}} )} \} \mspace{14mu} {and}}}}\mspace{20mu} {\mathcal{I}_{{({\rho,\Gamma})}, -}:={{{\{ { {i \in \mathcal{I}_{({\rho,\Gamma})}} \middle| {\rho (i)}  = {( {t,v_{i}} )}} \}.\mspace{20mu} {return}}\mspace{14mu} {msg}^{\prime}}:={c_{d + 1}/{( {\prod\limits_{\tau = 1}^{m}\; {K_{\tau,0}K_{\tau,1}}} ).}}}}}} & \;\end{matrix}$

Likewise, the CP-FE scheme indicated in Formulas 145 to 148 can bealtered to the attribute-based encryption scheme.

In the above explanation, n₀+u₀+w₀+z₀ is set in N₀ andn_(t)+u_(t)+w_(t)+z_(t) is set in N_(t). It for example, u₀=n₀, w₀=n₀,and z₀=2, then n₀+n₀+n₀+2=3n₀+2 may be set in N₀. If u_(t)=n_(t),w_(t)=n_(t), and z_(t)=1, then n_(t)+n_(t)+n_(t)+1=3n_(t)+1 may be setin N_(t).

Embodiment 3

Embodiment 3 will exemplify a functional encryption scheme in which, ascompared to the functional encryption scheme described in Embodiment 2,the number of bases increases but the dimension number of each basisdecreases.

Explanation will be given in Embodiment 3 mainly on portions that aredifferent from the cryptographic system 10 according to Embodiment 2.

The configurations of a key generation device 100, an encryption device200, and a decryption device 300 according to Embodiment 3 arerespectively the same as the configurations of the key generation device100, the encryption device 200, and the decryption device 300 accordingto Embodiment 2 shown in FIGS. 5 and 7.

The process of a Dec algorithm according to Embodiment 3 is the same asthe process of the Dec algorithm according to Embodiment 2. Hence, theprocesses of a Setup algorithm, KeyGen algorithm, and Enc algorithmaccording to Embodiment 3 will be described.

The process flows of the Setup algorithm, KeyGen algorithm, and Encalgorithm according to Embodiment 3 are the same as the process flows ofthe Setup algorithm, KeyGen algorithm, and Enc algorithm according toEmbodiment 2 shown in FIGS. 8 to 10.

The process of the Setup algorithm will be described with reference toFIG. 8.

(S101: Orthogonal Basis Generation Step)

The processes of (1) to (3) are the same as those in Embodiment 2.

(4) A master key generation part 110 sets n₀+u₀+w₀+z₀ in N₀, and setsn_(t)+u_(t)+w_(t)+z_(t) in N_(t) concerning each integer t of t=1, . . ., d (d is an integer of 1 or more). Note that n₀ is 1 and n_(t) is nwhere: n is an integer of 1 or more and u₀, w₀, z₀, u_(t), w_(t), andz_(t) are each an integer of 0 or more.

Subsequently, the master key generation part 110 executes processes (5)to (9) concerning integers τ, κ, ι, and t of τ=1 . . . , m, κ=0, . . . ,f_(τ), t=0, 1, and t=0, . . . , d.

The process of (5) is the same as that in Embodiment 2.

(6) The master key generation part 110 generates linear transformationX_(t) ^((τ,κ,ι)):=(χ_(t,i,j) ^((τ,κ,ι)) _(i,j) randomly, in the samemanner as in Embodiment 2.

(7) The master key generation part 110 generates X*_(t)^((τ,κ,ι)):=(ν_(t,i,j) ^((τ,κ,ι)))_(i,j):=ψ(X_(t) ^((τ,κ,ι)T))⁻¹, in thesame manner as in Embodiment 2.

(8) Based on the linear transformation X_(t) ^((τ,κ,ι)) generated in(6), the master key generation part 110 generates a basis B_(t)^((τ,κ,ι)) from a canonical basis A_(t) generated in (5), in the samemanner as in Embodiment 2.

(9) Based on the linear transformation X*_(t) ^((τ,κ,ι)) generated in(7), the master key generation part 110 generates a basis B*_(t)^((τ,κ,ι)) from the canonical basis A_(t) generated in (5), in the samemanner as in Embodiment 2.

The process of (10) is the same as that in Embodiment 2.

(S102: Public Parameter Generation Step)

With the processing device, the master key generation part 110 generatessubbases B̂₀ ^((τ,κ,ι)) and B̂_(t) ^((τ,κ,ι)) of the bases B₀ ^((τ,κ,ι))and B_(t) ^((τ,κ,ι)), respectively, which are generated in (S101), asindicated in Formula 154.

₀ ^((τ,κ,ι)) :=b _(0,1) ^((τ,κ,ι)) ,b _(0,n) ₀ _(+u) ₀ _(+w) ₀ ₊₁^((τ,κ,ι)) , . . . ,b _(0,n) ₀ _(+u) ₀ _(+w) ₀ _(+z) ₀ ^((τ,κ,ι))),

_(t) ^((τ,κ,ι)):=(b _(t,1) ^((τ,κ,ι)) , . . . ,b _(t,n) ^((τ,κ,ι)) ,b_(t,n) _(t) _(+u) _(t) _(+w) _(t) ₊₁ ^((τ,κ,ι)) , . . . ,b _(t,n) _(t)_(+u) _(t) _(+w) _(t) _(+z) _(t) ^((τ,κ,ι)))  [Formula 154]

-   -   for t=1, . . . , d

The master key generation part 110 treats the generated subbases B̂₀^((τ,κ,ι)) and B̂_(t) ^((τ,κ,ι)), the security parameter λ inputted in(S101), and param generated in (S101), to form public parameters pk.

(S103: Master Key Generation Step)

With the processing device, the master key generation part 110 generatessubbases B̂*₀ ^((τ,κ,ι)) and B̂*_(t) ^((τ,κ,ι)) of the bases B*₀^((τ,κ,ι)) and B*_(t) ^((τ,κ,ι)), respectively, which are generated in(S101), as indicated in Formula 155.

*₀ ^((τ,κ,ι)):=(b* _(0,1) ^((τ,κ,ι)) , . . . ,b* _(0,n) ₀ ^((τ,κ,ι)) ,b*_(0,n) ₀ _(+u) ₀ ₊₁ ^((τ,κ,ι)) , . . . ,b* _(0,n) ₀ _(+u) ₀ _(+w) ₀^((τ,κ,ι)) ,b* _(0,n) ₀ _(+u) ₀ _(+w) ₀ _(+z) ₀ ^((τ,κ,ι))),

*_(t) ^((τ,κ,ι)):=(b* _(t,1) ^((τ,κ,ι)) , . . . ,b* _(t,n) _(t)^((τ,κ,ι)) ,b* _(t,n) _(t) _(+u) _(t) ₊₁ ^((τ,κ,ι)) , . . . ,b* _(t,n)_(t) _(+u) _(t) _(+w) _(t) ^((τ,κ,ι)))  [Formula 155]

-   -   for t=1, . . . , d

The master key generation part 110 treats the generated subbases B̂*₀^((τ,κ,ι)) and B̂*_(t) ^((τ,κ,ι)), to form the master key sk.

The process of (S104) is the same as that in Embodiment 2.

In brief, from (S101) through (S103), the key generation device 100generates the public parameters pk and the master key sk by executingthe Setup algorithm indicated in Formula 156. Then, in (S104), the keygeneration device 100 stores the generated public parameters pk andmaster key sk, in the storage device.

$\begin{matrix}{\mspace{79mu} {{{{Setup}( 1^{\lambda} )}\text{:}}{{( {{param},( {_{t}^{({\tau,\kappa,\iota})},_{t}^{*{({\tau,\kappa,\iota})}}} )_{{t = 0},\ldots \mspace{14mu},{d;{\tau = 1}},\ldots \mspace{14mu},{m;{\kappa = 0}},\ldots \mspace{14mu},{f_{\tau};{\iota = 0}},1}} )\overset{R}{}{_{ob}( 1^{\lambda} )}},\mspace{20mu} {{{for}\mspace{14mu} \tau} = 1},\ldots \mspace{14mu},{{m\mspace{14mu} \kappa} = 0},\ldots \mspace{14mu},f_{\tau},\mspace{14mu} {\iota = 0},1,{{\hat{}}_{0}^{({\tau,\kappa,\iota})}:=( {b_{0,1}^{({\tau,\kappa,\iota})},b_{0,{n_{0} + u_{0} + w_{0} + 1}}^{({\tau,\kappa,\iota})},\ldots \mspace{14mu},b_{0,{n_{0} + u_{0} + w_{0} + z_{0}}}^{({\tau,\kappa,\iota})}} )},{{\hat{}}_{t}^{({\tau,\kappa,\iota})}:=( {b_{t,1}^{({\tau,\kappa,\iota})},\ldots \mspace{14mu},b_{t,n}^{({\tau,\kappa,\iota})},b_{t,{n_{t} + u_{t} + w_{t} + 1}}^{({\tau,\kappa,\iota})},\ldots \mspace{14mu},b_{t,{n_{t} + u_{t} + w_{t} + z_{t}}}^{({\tau,\kappa,\iota})}} )}}\mspace{20mu} {{{{for}\mspace{14mu} t} = 1},\ldots \mspace{14mu},d,{{\hat{}}_{0}^{*{({\tau,\kappa,\iota})}}:=( {b_{0,1}^{*{({\tau,\kappa,\iota})}},\ldots \mspace{14mu},b_{0,n_{0}}^{*{({\tau,\kappa,\iota})}},b_{0,{n_{0} + u_{0} + 1}}^{*{({\tau,\kappa,\iota})}},\ldots \mspace{14mu},b_{0,{n_{0} + u_{0} + w_{0}}}^{*{({\tau,\kappa,\iota})}},b_{0,{n_{0} + u_{0} + w_{0} + z_{0}}}^{*{({\tau,\kappa,\iota})}}} )},{{\hat{}}_{t}^{*{({\tau,\kappa,\iota})}}:=( {b_{t,1}^{*{({\tau,\kappa,\iota})}},\ldots \mspace{14mu},b_{t,n_{t}}^{*{({\tau,\kappa,\iota})}},b_{t,{n_{t} + u_{t} + 1}}^{*{({\tau,\kappa,\iota})}},\ldots \mspace{14mu},b_{t,{n_{t} + u_{t} + w_{t}}}^{*{({\tau,\kappa,\iota})}}} )}}\mspace{20mu} {{{{for}\mspace{14mu} t} = 1},\ldots \mspace{14mu},d,\mspace{20mu} {{{return}\mspace{14mu} {pk}}:=( {1^{\lambda},\{ {\hat{}}_{t} \}_{{t = 0},\ldots \mspace{14mu},d},{param}} )},\mspace{20mu} {{sk}:={\{ {\hat{}}_{t}^{*} \}_{{t = 0},\ldots \mspace{14mu},d}.}}}}} & \lbrack {{Formula}\mspace{14mu} 156} \rbrack\end{matrix}$

The process of the KeyGen algorithm will be described with reference toFIG. 9.

The processes of (S201) through (S204) and of (S206) are the same asthose in Embodiment 2.

(S205: Key Element Generation Step)

With the processing device, concerning each integer τ of τ=1 . . . , m,each integer κ of κ=0, . . . , f_(τ), and each integer ι of ι=0, 1, akey element generation part 142 generates an element k*₀ ^((τ,κ,ι)) of adecryption key sk_(s), as indicated in Formula 157.

$\begin{matrix}{\mspace{79mu} {{{\overset{arrow}{\eta}}_{0}^{({\tau,\kappa,\iota})}\overset{U}{}_{q}^{w_{0}}},{k_{0}^{*{({\tau,\kappa,\iota})}}:={( {\overset{\overset{n_{0}}{}}{s_{0}^{({\tau,\kappa,\iota})} + \pi_{\tau,\kappa,\iota}},\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0},\overset{\overset{w_{0}}{}}{{\overset{arrow}{\eta}}_{0}^{({\tau,\kappa,\iota})}},\overset{\overset{z_{0}}{}}{0,\ldots \mspace{14mu},0,\chi_{\tau,\kappa,\iota}}} )_{0}^{*{({\tau,\kappa,\iota})}}}}}} & \lbrack {{Formula}\mspace{14mu} 157} \rbrack\end{matrix}$

With the processing device, concerning each integer τ of τ=1 . . . , m,each integer κ of κ=0, . . . , f_(τ), each integer ι of ι=0, 1, and eachinteger i of i=1, . . . , L, the key element generation part 142generates an element k*_(i) ^((τ,κ,ι)) of the decryption key sk_(s), asindicated in Formula 158.

$\begin{matrix}{{{{if}\mspace{14mu} {\rho (i)}} = ( {t,{\overset{arrow}{v}}_{i}} )},\mspace{14mu} {\theta_{i}\overset{U}{}_{q}},{{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{w_{t}}},{k_{i}^{*{({\tau,\kappa,\iota})}}:={\begin{pmatrix}{\overset{\overset{n_{t}}{}}{{s_{i}^{({\tau,\kappa,\iota})}{\overset{arrow}{e}}_{1}} + {\theta_{i}{\overset{arrow}{v}}_{i}}},} \\{\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0},\overset{\overset{w_{t}}{}}{{\overset{arrow}{\eta}}_{i}},\overset{\overset{z_{t}}{}}{0,\ldots \mspace{14mu},0}}\end{pmatrix}_{t}^{*{({\tau,\kappa,\iota})}}}},{{{if}\mspace{14mu} {\rho (i)}} = {( {t,{\overset{arrow}{v}}_{i}} )}},\mspace{14mu} {{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{w_{t}}},{k_{i}^{*{({\tau,\kappa,\iota})}}:={\begin{pmatrix}{\overset{\overset{n_{t}}{}}{s_{i}^{({\tau,\kappa,\iota})}{\overset{arrow}{v}}_{i}},} \\{\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0},\overset{\overset{w_{t}}{}}{{\overset{arrow}{\eta}}_{i}},\overset{\overset{z_{t}}{}}{0,\ldots \mspace{14mu},0}}\end{pmatrix}_{t}^{*{({\tau,\kappa,\iota})}}}},{{{if}\mspace{14mu} {\rho (i)}} = p_{0}},\mspace{14mu} {{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{w_{0}}},{k_{i}^{*{({\tau,\kappa,\iota})}}:={\begin{pmatrix}{\overset{\overset{n_{0}}{}}{s_{i}^{({\tau,\kappa,\iota})}},} \\{\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0},\overset{\overset{w_{0}}{}}{{\overset{arrow}{\eta}}_{i}},\overset{\overset{z_{0}}{}}{0,\ldots \mspace{14mu},0}}\end{pmatrix}_{0}^{*{({\tau,\kappa,\iota})}}}}} & \lbrack {{Formula}\mspace{14mu} 158} \rbrack\end{matrix}$

In brief, from (S201) through (S205), the key generation device 100generates the decryption key sk_(s) by executing the KeyGen algorithmindicated in Formulas 159 to 160. Then, in (S206), the key generationdevice 100 distributes the generated decryption key sk_(s) to thedecryption device 300.

$\begin{matrix}{{{{KeyGen}( {{pk},{sk},{:=( {,\mathcal{B},{{d(x)} = {\prod\limits_{\tau = 1}^{m}\; {d_{\tau}(x)}^{f_{\tau}}}},\rho} )}} )}\text{:}}\mspace{20mu} {{\pi_{\tau}\overset{U}{}_{q}},( {{\tau = 1},\ldots \mspace{14mu},{m - 1}} ),{\pi_{m}:={- {\sum\limits_{\tau = 1}^{m - 1}\pi_{\tau}}}},\mspace{79mu} {\pi_{\tau,\kappa,0}\overset{U}{}_{q}},}} & \lbrack {{Formula}\mspace{14mu} 159} \rbrack \\{{\pi_{\tau,\kappa,1}:={\pi_{\tau} - {\pi_{\tau,\kappa,0}( {{\tau = 1},\ldots \mspace{14mu},{m;{\kappa = 0}},\ldots \mspace{14mu},f_{\tau}} )}}},\mspace{20mu} {\chi_{\tau}\overset{U}{}_{q}},( {{\tau = 1},\ldots \mspace{14mu},{m - 1}} ),{\chi_{m}:={1 - {\sum\limits_{\tau = 1}^{m - 1}\chi_{\tau}}}},\mspace{79mu} {\chi_{\tau,\kappa,0}\overset{U}{}_{q}},{\chi_{\tau,\kappa,1}:={\chi_{\tau} - {\chi_{\tau,\kappa,0}( {{\tau = 1},\ldots \mspace{20mu},{m;{\kappa = 0}},\ldots \mspace{14mu},f_{\tau}} )}}},\mspace{20mu} {{{for}\mspace{14mu} \tau} = 1},\ldots \mspace{14mu},m,{\kappa = 0},\ldots \mspace{20mu},f_{\tau},{\iota = 0},1,\mspace{20mu} {\mu^{({\tau,\kappa,0})}:={\deg ( {d_{\tau}(x)}^{\kappa} )}},{\mu^{({\tau,\kappa,1})}:={\deg ( {d_{\tau}(x)}^{f_{\tau} - \kappa} )}},\mspace{79mu} ( {{\kappa = 0},\ldots \mspace{14mu},f_{\tau}} ),{{a_{i,0}^{({\tau,\kappa})} + {a_{i,1}^{({\tau,\kappa})}x} + \ldots + {a_{i,{\mu^{({\tau,\kappa,0})} - 1}}^{({\tau,\kappa})}x^{\mu^{({\tau,\kappa,0})} - 1}}}:={{a_{i}(x)}{mod}\; {d_{\tau}(x)}^{\kappa}}},} & \; \\{{{b_{i,0}^{({\tau,k})} + {b_{i,1}^{({\tau,\kappa})}x} + \ldots + {b_{i,{\mu^{({\tau,\kappa,1})} - 1}}^{({\tau,\kappa})}x^{\mu^{({\tau,\kappa,1})} - 1}}}:={{b_{i}(x)}{mod}\; {d_{\tau}(x)}^{f_{\tau} - \kappa}}},\mspace{20mu} {\delta_{j}^{({\tau,\kappa,\iota})}\overset{U}{}_{q}},( {{j = 0},\ldots \mspace{14mu},{\mu^{({\tau,\kappa,\iota})} - 1}} ),\mspace{20mu} {{{\overset{arrow}{\eta}}_{0}}^{({\tau,\kappa,\iota})}\overset{U}{}_{q}^{w_{0}}},\mspace{20mu} {s_{0}^{({\tau,\kappa,0})}:={\sum\limits_{j = 0}^{\mu^{({\tau,\kappa,0})} - 1}{\delta_{j}^{({\tau,\kappa,0})} \cdot a_{0,j}^{({\tau,\kappa})}}}},\mspace{20mu} {s_{0}^{({\tau,\kappa,1})}:={\sum\limits_{j = 0}^{\mu^{({\tau,\kappa,1})} - 1}{\delta_{j}^{({\tau,\kappa,1})} \cdot b_{0,j}^{({\tau,\kappa})}}}},} & \; \\{{k_{0}^{*{({\tau,\kappa,\iota})}}:={( {\overset{\overset{n_{0}}{}}{{s_{0}^{({\tau,\kappa,\iota})} + \pi_{\tau,\kappa,\iota}},}\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{0}}{}}{{\overset{arrow}{\eta}}_{0}^{({\tau,\kappa,\iota})},}\overset{\overset{z_{0}}{}}{0,\ldots \mspace{20mu},0,\chi_{\tau,\kappa,\iota}}} )_{0}^{*{({\tau,\kappa,\iota})}}}},\mspace{20mu} {{{for}\mspace{14mu} i} = 1},\ldots \mspace{14mu},L,} & \lbrack {{Formula}\mspace{14mu} 160} \rbrack \\{{\xi_{i,\tau,\iota}\overset{U}{}{_{q}( {{i = 1},\ldots \mspace{14mu},{L;{\tau = 1}},\ldots \mspace{14mu},{{m - 1};{\iota = 0}},1} )}},\mspace{20mu} {\xi_{i,\tau,\iota}:={- {\sum\limits_{\tau = 1}^{m - 1}{\xi_{i,\tau,\iota}( {{i = 1},\ldots \mspace{20mu},{L;{\iota = 0}},1} )}}}},\mspace{20mu} {s_{i}^{({\tau,\kappa,0})}:={{\sum\limits_{j = 0}^{\mu^{({\tau,\kappa,0})} - 1}{\delta_{j}^{({\tau,\kappa,0})} \cdot a_{i,j}^{({\tau,k})}}} + \xi_{i,\tau,0}}},\mspace{20mu} {s_{i}^{({\tau,\kappa,1})}:={{\sum\limits_{j = 0}^{\mu^{({\tau,\kappa,1})} - 1}{\delta_{j}^{({\tau,\kappa,1})} \cdot b_{i,j}^{({\tau,k})}}} + \xi_{i,\tau,1}}},\mspace{20mu} {{{if}\mspace{14mu} {\rho (i)}} = ( {t,{\overset{arrow}{v}}_{i}} )},{\theta_{i}\overset{U}{}_{q}},{{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{w_{t}}},} & \; \\{{k_{i}^{*{({\tau,\kappa,\iota})}}:={( {\overset{\overset{n_{t}}{}}{{{s_{i}^{({\tau,\kappa,\iota})}{\overset{arrow}{e}}_{1}} + {\theta_{i}{\overset{arrow}{v}}_{i}}},}\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{t}}{}}{{\overset{arrow}{\eta}}_{i},}\overset{\overset{z_{t}}{}}{0,\ldots \mspace{20mu},0}} )_{t}^{*{({\tau,\kappa,\iota})}}}},\mspace{20mu} {{{if}\mspace{14mu} {\rho (i)}} = {( {t,{\overset{arrow}{v}}_{i}} )}},{{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{w_{t}}},\mspace{20mu} {k_{i}^{*{({\tau,\kappa,\iota})}}:={( {\overset{\overset{n_{t}}{}}{{s_{i}^{({\tau,\kappa,\iota})}{\overset{arrow}{v}}_{i}},}\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{t}}{}}{{\overset{arrow}{\eta}}_{i},}\overset{\overset{z_{t}}{}}{0,\ldots \mspace{20mu},0}} )_{t}^{*{({\tau,\kappa,\iota})}}}},\mspace{20mu} {{{if}\mspace{14mu} {\rho (i)}} = p_{0}},{{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{w_{0}}},\mspace{20mu} {k_{i}^{*{({\tau,\kappa,\iota})}}:={( {\overset{\overset{n_{0}}{}}{s_{i}^{({\tau,\kappa,\iota})},}\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{0}}{}}{{\overset{arrow}{\eta}}_{i},}\overset{\overset{z_{0}}{}}{0,\ldots \mspace{20mu},0}} )_{0}^{*{({\tau,\kappa,\iota})}}}},} & \; \\{{{return}\mspace{14mu} {sk}_{}}:={( {,\{ {k_{0}^{*{({\tau,\kappa,\iota})}},k_{1}^{*{({\tau,\kappa,\iota})}},\ldots \mspace{14mu},k_{L}^{*{({\tau,\kappa,\iota})}}} \}_{{\tau = 1},\; \ldots \mspace{11mu},{m;{\kappa = 0}},\; \ldots \mspace{11mu},{f_{\tau};{\iota = 0}},1}} ).}} & \;\end{matrix}$

The process of the Enc algorithm will be described with reference toFIG. 10.

The processes of (S301) through (S302) and of (S304) are the same asthose in Embodiment 2.

(S303: Cipher Element Generation Step)

With the processing device, an encrypted data generation part 230generates an element c₀ ^((τ,κ,ι)) of a ciphertext ct_(Γ), as indicatedin Formula 161.

$\begin{matrix}{\mspace{85mu} {\omega,{\zeta \overset{U}{}_{q}},\mspace{85mu} {{\overset{arrow}{\phi}}_{0}\overset{U}{}_{q}^{z_{0} - 1}},\; {c_{0}^{({\tau,\kappa,\iota})}:={\begin{pmatrix}\overset{\overset{n_{0}}{}}{\omega,} & \overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0,} & \overset{\overset{w_{0}}{}}{0,\ldots \mspace{14mu},0,} & \overset{\overset{z_{0}}{}}{{\overset{arrow}{\phi}}_{0},\zeta}\end{pmatrix}_{0}^{({\tau,\kappa,\iota})}}}}} & \lbrack {{Formula}\mspace{14mu} 161} \rbrack\end{matrix}$

With the processing device, concerning each integer t included inattribute information Γ, the encrypted data generation part 230generates an element c_(t) ^((τ,κ,ι)) of the ciphertext ct_(Γ), asindicated in Formula 162.

$\begin{matrix}{\mspace{79mu} {{{{{\overset{arrow}{\phi}}_{t}\overset{U}{}_{q}^{z_{t}}}\mspace{14mu} {for}\mspace{14mu} ( {t,{\overset{arrow}{x}}_{t}} )} \in \Gamma},{c_{t}^{({\tau,\kappa,\iota})}:={\begin{pmatrix}\overset{\overset{n_{t}}{}}{{\omega \; {\overset{arrow}{x}}_{t}},} & \overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0,} & \overset{\overset{w_{t}}{}}{0,\ldots \mspace{14mu},0,} & \overset{\overset{z_{t}}{}}{{\overset{arrow}{\phi}}_{t}}\end{pmatrix}_{t}^{({\tau,\kappa,\iota})}}}}} & \lbrack {{Formula}\mspace{14mu} 162} \rbrack\end{matrix}$

With the processing device, the encrypted data generation part 230generates an element c_(d+1) of the ciphertext ct_(Γ), as indicated inFormula 163.

c _(d+1) :=g _(T) ^(ζ) msg  [Formula 163]

In brief, from (S301) through (S303), the encryption device 200generates the ciphertext ct_(Γ) by executing the Enc algorithm indicatedin Formula 164. Then, in (S304), the encryption device 200 transmits thegenerated ciphertext ct_(Γ) to the decryption device 300.

$\begin{matrix}{{{{Enc}( {{pk},{msg},{\Gamma:=\{ ( {t,{\overset{arrow}{x}}_{t}} ) \middle| {1 \leq t \leq d} \}}} )}\text{:}}{\omega,{\zeta \overset{U}{}_{q}},{{\overset{arrow}{\phi}}_{0}\overset{U}{}_{q}^{z_{0} - 1}},{{{{\overset{arrow}{\phi}}_{t}\overset{U}{}_{q}^{z_{t}}}\mspace{14mu} {for}\mspace{14mu} ( {t,{\overset{arrow}{x}}_{t}} )} \in \Gamma},{c_{0}^{({t,\kappa,\iota})}:={( {\overset{\overset{n_{0}}{}}{\omega,}\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0,}\mspace{14mu} \overset{\overset{w_{0}}{}}{0,\ldots \mspace{14mu},0,}\mspace{14mu} \overset{\overset{z_{0}}{}}{{\overset{arrow}{\phi}}_{0},\zeta}} )_{0}^{({\tau,\kappa,\iota})}}},{c_{t}^{({t,\kappa,\iota})}:={( {\overset{\overset{n_{t}}{}}{{\omega \; {\overset{arrow}{x}}_{t}},}\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0,}\mspace{14mu} \overset{\overset{w_{t}}{}}{0,\ldots \mspace{14mu},0,}\mspace{14mu} \overset{\overset{z_{t}}{}}{{\overset{arrow}{\phi}}_{t}}} )_{t}^{({\tau,\kappa,\iota})}}},{{{for}\mspace{14mu} ( {t,{\overset{arrow}{x}}_{t}} )} \in \Gamma},{c_{d + 1}:={g_{T}^{\zeta}{msg}}},{{{return}\mspace{14mu} {ct}_{\Gamma}}:={( {\Gamma,c_{0},\{ c_{t} \}_{{({t,{\overset{arrow}{x}}_{t}})} \in \Gamma},c_{d + 1}} ).}}}} & \lbrack {{Formula}\mspace{14mu} 164} \rbrack\end{matrix}$

As described above, the encryption system 10 according to Embodiment 3implements a functional encryption scheme in which, as compared to thefunctional encryption scheme described in Embodiment 2, the number ofbases increases but the dimension number of each basis decreases.

The KP-FE scheme has been described above. If the KeyGen algorithm andEnc algorithm are modified as indicated in Formulas 165 to 167, theCP-FE scheme may be realized. Note that the Setup algorithm is the samebetween the KP-FE scheme and the CP-FE scheme. The Dec algorithm is thesame as the Dec algorithm indicated in Formula 148.

$\begin{matrix}{\mspace{79mu} {{{{KeyGen}( {{pk},{sk},{\Gamma:=\{ ( {t,{\overset{arrow}{x}}_{t}} ) \middle| {1 \leq t \leq d} \}}} )}\text{:}}\mspace{20mu} {{\omega \overset{U}{}_{q}},\mspace{20mu} {{\overset{arrow}{\phi}}_{0}\overset{U}{}_{q}^{w_{0}}},\mspace{20mu} {{{{\overset{arrow}{\phi}}_{t}\overset{U}{}_{q}^{w_{t}}}\mspace{14mu} {for}\mspace{14mu} ( {t,{\overset{arrow}{x}}_{t}} )} \in \Gamma},{k_{0}^{*{({t,\kappa,\iota})}}:={( {\overset{\overset{n_{0}}{}}{\omega,}\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0,}\mspace{14mu} \overset{\overset{w_{0}}{}}{{\overset{arrow}{\phi}}_{0},}\mspace{14mu} \overset{\overset{z_{0}}{}}{0,\ldots \mspace{14mu},0,1}} )_{0}^{*{({\tau,\kappa,\iota})}}}},\mspace{20mu} {k_{t}^{*{({t,\kappa,\iota})}}:={( {\overset{\overset{n_{t}}{}}{{\omega \; {\overset{arrow}{x}}_{t}},}\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0,}\mspace{14mu} \overset{\overset{w_{t}}{}}{{\overset{arrow}{\phi}}_{t},}\mspace{14mu} \overset{\overset{z_{t}}{}}{0,\ldots \mspace{14mu},0}} )_{t}^{*{({\tau,\kappa,\iota})}}}},\mspace{20mu} {{{for}\mspace{14mu} ( {t,{\overset{arrow}{x}}_{t}} )} \in \Gamma},\mspace{20mu} {{{return}\mspace{14mu} {sk}_{\Gamma}}:={( {\Gamma,k_{0}^{*},\{ k_{t}^{*} \}_{{({t,{\overset{arrow}{x}}_{t}})} \in \Gamma}} ).}}}}} & \lbrack {{Formula}\mspace{14mu} 165} \rbrack \\{{{{Enc}( {{pk},{msg},{:=( {,\mathcal{B},{{d(x)} = {\prod\limits_{\tau = 1}^{m}\; {d_{\tau}(x)}^{f_{\tau}}}},\rho} )}} )}\text{:}}\mspace{20mu} {{\pi_{\tau}\overset{U}{}_{q}},( {{\tau = 1},\ldots \mspace{14mu},{m - 1}} ),{\pi_{m}:={- {\sum\limits_{\tau = 1}^{m - 1}\pi_{\tau}}}},\mspace{79mu} {\pi_{\tau,\kappa,0}\overset{U}{}_{q}},}} & \lbrack {{Formula}\mspace{14mu} 166} \rbrack \\{{\pi_{\tau,\kappa,1}:={\pi_{\tau} - {\pi_{\tau,\kappa,0}( {{\tau = 1},\ldots \mspace{14mu},{m;{\kappa = 0}},\ldots \mspace{14mu},f_{\tau}} )}}},\mspace{20mu} {\chi_{\tau}\overset{U}{}_{q}},( {{\tau = 1},\ldots \mspace{14mu},{m - 1}} ),{\chi_{m}:={1 - {\sum\limits_{\tau = 1}^{m - 1}\chi_{\tau}}}},\mspace{79mu} {\chi_{\tau,\kappa,0}\overset{U}{}_{q}},{\chi_{\tau,\kappa,1}:={\chi_{\tau} - {\chi_{\tau,\kappa,0}( {{\tau = 1},\ldots \mspace{20mu},{m;{\kappa = 0}},\ldots \mspace{14mu},f_{\tau}} )}}},\mspace{20mu} {{{for}\mspace{14mu} \tau} = 1},\ldots \mspace{14mu},m,{\kappa = 0},\ldots \mspace{20mu},f_{\tau},{\iota = 0},1,\mspace{20mu} {\mu^{({\tau,\kappa,0})}:={\deg ( {d_{\tau}(x)}^{\kappa} )}},{\mu^{({\tau,\kappa,1})}:={\deg ( {d_{\tau}(x)}^{f_{\tau} - \kappa} )}},\mspace{20mu} ( {{\kappa = 0},\ldots \mspace{14mu},f_{\tau}} ),{{a_{i,0}^{({\tau,\kappa})} + {a_{i,1}^{({\tau,\kappa})}x} + \ldots + {a_{i,{\mu^{({\tau,\kappa,0})} - 1}}^{({\tau,\kappa})}x^{\mu^{({\tau,\kappa,0})} - 1}}}:={{a_{i}(x)}{mod}\; {d_{\tau}(x)}^{\kappa}}},} & \; \\{{{b_{i,0}^{({\tau,k})} + {b_{i,1}^{({\tau,\kappa})}x} + \ldots + {b_{i,{\mu^{({\tau,\kappa,1})} - 1}}^{({\tau,\kappa})}x^{\mu^{({\tau,\kappa,1})} - 1}}}:={{b_{i}(x)}{mod}\; {d_{\tau}(x)}^{f_{\tau} - \kappa}}},\mspace{20mu} {\delta_{j}^{({\tau,\kappa,\iota})}\overset{U}{}_{q}},( {{j = 0},\ldots \mspace{14mu},{\mu^{({\tau,\kappa,\iota})} - 1}} ),\mspace{20mu} {{{\overset{arrow}{\eta}}_{0}}^{({\tau,\kappa,\iota})}\overset{U}{}_{q}^{z_{0} - 1}},\mspace{20mu} {s_{0}^{({\tau,\kappa,0})}:={\sum\limits_{j = 0}^{\mu^{({\tau,\kappa,0})} - 1}{\delta_{j}^{({\tau,\kappa,0})} \cdot a_{0,j}^{({\tau,\kappa})}}}},\mspace{20mu} {s_{0}^{({\tau,\kappa,1})}:={\sum\limits_{j = 0}^{\mu^{({\tau,\kappa,1})} - 1}{\delta_{j}^{({\tau,\kappa,1})} \cdot b_{0,j}^{({\tau,\kappa})}}}},} & \; \\{{c_{0}^{({\tau,\kappa,\iota})}:={( {\overset{\overset{n_{0}}{}}{{s_{0}^{({\tau,\kappa,\iota})} + \pi_{\tau,\kappa,\iota}},}\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{z_{0}}{}}{{\overset{arrow}{\eta}}_{0}^{({\tau,\kappa,\iota})},{\zeta\chi}_{\tau,\kappa,\iota}}} )_{0}^{({\tau,\kappa,\iota})}}},\mspace{20mu} {{{for}\mspace{14mu} i} = 1},\ldots \mspace{14mu},L,} & \lbrack {{Formula}\mspace{14mu} 167} \rbrack \\{{\xi_{i,\tau,\iota}\overset{U}{}{_{q}( {{i = 1},\ldots \mspace{14mu},{L;{\tau = 1}},\ldots \mspace{14mu},{{m - 1};{\iota = 0}},1} )}},\mspace{20mu} {\xi_{i,\tau,\iota}:={- {\sum\limits_{\tau = 1}^{m - 1}{\xi_{i,\tau,\iota}( {{i = 1},\ldots \mspace{20mu},{L;{\iota = 0}},1} )}}}},\mspace{20mu} {s_{i}^{({\tau,\kappa,0})}:={{\sum\limits_{j = 0}^{\mu^{({\tau,\kappa,0})} - 1}{\delta_{j}^{({\tau,\kappa,0})} \cdot a_{i,j}^{({\tau,k})}}} + \xi_{i,\tau,0}}},\mspace{20mu} {s_{i}^{({\tau,\kappa,1})}:={{\sum\limits_{j = 0}^{\mu^{({\tau,\kappa,1})} - 1}{\delta_{j}^{({\tau,\kappa,1})} \cdot b_{i,j}^{({\tau,k})}}} + \xi_{i,\tau,1}}},\mspace{20mu} {{{if}\mspace{14mu} {\rho (i)}} = ( {t,{\overset{arrow}{v}}_{i}} )},{\theta_{i}\overset{U}{}_{q}},{{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{z_{t}}},} & \; \\{{c_{i}^{({\tau,\kappa,\iota})}:={( {\overset{\overset{n_{t}}{}}{{{s_{i}^{({\tau,\kappa,\iota})}{\overset{arrow}{e}}_{1}} + {\theta_{i}{\overset{arrow}{v}}_{i}}},}\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{t}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{z_{t}}{}}{{\overset{arrow}{\eta}}_{i}}} )_{t}^{({\tau,\kappa,\iota})}}},\mspace{20mu} {{{if}\mspace{14mu} {\rho (i)}} = {( {t,{\overset{arrow}{v}}_{i}} )}},{{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{z_{t}}},\mspace{20mu} {c_{i}^{({\tau,\kappa,\iota})}:={( {\overset{\overset{n_{t}}{}}{{s_{i}^{({\tau,\kappa,\iota})}{\overset{arrow}{v}}_{i}},}\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{t}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{z_{t}}{}}{{\overset{arrow}{\eta}}_{i}}} )_{t}^{({\tau,\kappa,\iota})}}},\mspace{20mu} {{{if}\mspace{14mu} {\rho (i)}} = p_{0}},{{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{z_{0}}},\mspace{20mu} {c_{i}^{({\tau,\kappa,\iota})}:={( {\overset{\overset{n_{0}}{}}{s_{i}^{({\tau,\kappa,\iota})},}\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{z_{0}}{}}{{\overset{arrow}{\eta}}_{i}}} )_{0}^{({\tau,\kappa,\iota})}}},\mspace{20mu} {c_{d + 1}:={g_{T}^{\zeta}{msg}}},} & \; \\{{{return}\mspace{14mu} {ct}_{}}:={( {,\{ {c_{0}^{({\tau,\kappa,\iota})},c_{1}^{({\tau,\kappa,\iota})},\ldots \mspace{14mu},c_{L}^{({\tau,\kappa,\iota})}} \}_{{\tau = 1},\; \ldots \mspace{11mu},{m;{\kappa = 0}},\; \ldots \mspace{11mu},{f_{\tau};{\iota = 0}},1},c_{{d + 1}\;}} ).}} & \;\end{matrix}$

The functional encryption scheme has been described above. If the Setupalgorithm, KeyGen algorithm, and Enc algorithm are modified as indicatedin Formulas 168 to 171, an attribute-based encryption scheme may berealized. With the attribute-based encryption scheme, in the Setupalgorithm, n_(t) is 2. The Dec algorithm is the same as the Decalgorithm indicated in Formula 153.

$\begin{matrix}{\mspace{79mu} {{{{{Setup}( 1^{\lambda} )}:{( {{param},( {_{t}^{({\tau,\kappa,\iota})},_{t}^{*{({\tau,\kappa,\iota})}}} )_{{t = 0},\; \ldots \mspace{11mu},{d;{t = 1}},\; \ldots \;,{m;{\kappa = 0}},\; {{\ldots \mspace{11mu} f_{\tau}};{\iota = 0.1}}}} )\overset{R}{}{_{ob}( 1^{\lambda} )}}},\mspace{20mu} {{{for}\mspace{14mu} \tau} = 1},\ldots \mspace{14mu},m,{\kappa = 0},\ldots \mspace{14mu},f_{\tau},{\iota = 0},1,{{\hat{}}_{0}^{({\tau,\kappa,\iota})}:=( {b_{0,1}^{({\tau,\kappa,\iota})},b_{0,{n_{0} + u_{0} + w_{0} + 1}}^{({\tau,\kappa,\iota})},\ldots \mspace{14mu},b_{0,{n_{0} + u_{0} + w_{0} + z_{0}}}^{({\tau,\kappa,\iota})}} )},{{\hat{}}_{t}^{({\tau,\kappa,\iota})}:=( {b_{t,1}^{({\tau,\kappa,\iota})},b_{t,2}^{({\tau,\kappa,\iota})},b_{t,{n_{t} + u_{t} + w_{t} + 1}}^{({\tau,\kappa,\iota})},\ldots \mspace{14mu},b_{t,{n_{t} + u_{t} + w_{t} + z_{t}}}^{({\tau,\kappa,\iota})}} )}}\mspace{20mu} {{{{for}\mspace{14mu} t} = 1},\ldots \mspace{14mu},d,{{\hat{}}_{0}^{*{({\tau,\kappa,\iota})}}:=( {b_{0,1}^{*{({\tau,\kappa,\iota})}},b_{0,{1 + u_{0} + 1}}^{*{({\tau,\kappa,\iota})}},\ldots \mspace{14mu},b_{0,{1 + u_{0} + w_{0}}}^{*{({\tau,\kappa,\iota})}},b_{0,{1 + u_{0} + w_{0} + z_{0}}}^{*{({\tau,\kappa,\iota})}}} )},{{\hat{}}_{t}^{*{({\tau,\kappa,\iota})}}:=( {b_{t,1}^{*{({\tau,\kappa,\iota})}},b_{t,2}^{*{({\tau,\kappa,\iota})}},b_{t,{2 + u_{t} + 1}}^{*{({\tau,\kappa,\iota})}},\ldots \mspace{14mu},b_{t,{2 + u_{t} + w_{t}}}^{*{({\tau,\kappa,\iota})}}} )}}\mspace{20mu} {{{{for}\mspace{14mu} t} = 1},\ldots \mspace{20mu},d,\mspace{20mu} {{{return}\mspace{14mu} {pk}}:=( {1^{\lambda},\{ {\hat{}}_{t} \}_{{t = 0},\; \ldots \mspace{11mu},d},{param}} )},\mspace{20mu} {{sk}:={\{ {\hat{}}_{t}^{*} \}_{{t = 0},\; \ldots \mspace{11mu},d}.}}}}} & \lbrack {{Formula}\mspace{14mu} 168} \rbrack \\{{{{KeyGen}( {{pk},{msg},{:=( {,\mathcal{B},{{d(x)} = {\prod\limits_{\tau = 1}^{m}\; {d_{\tau}(x)}^{f_{\tau}}}},\rho} )}} )}\text{:}}\mspace{20mu} {{\pi_{\tau}\overset{U}{}_{q}},( {{\tau = 1},\ldots \mspace{14mu},{m - 1}} ),{\pi_{m}:={- {\sum\limits_{\tau = 1}^{m - 1}\pi_{\tau}}}},\mspace{79mu} {\pi_{\tau,\kappa,0}\overset{U}{}_{q}},{\pi_{\tau,\kappa,1}:={\pi_{\tau} - {\pi_{\tau,\kappa,0}( {{\tau = 1},\ldots \mspace{14mu},{m;{\kappa = 0}},\ldots \mspace{14mu},f_{\tau}} )}}},\mspace{20mu} {\chi_{\tau}\overset{U}{}_{q}},( {{\tau = 1},\ldots \mspace{14mu},{m - 1}} ),{\chi_{m}:={1 - {\sum\limits_{\tau = 1}^{m - 1}\chi_{\tau}}}},\mspace{79mu} {\chi_{\tau,\kappa,0}\overset{U}{}_{q}},{\chi_{\tau,\kappa,1}:={\chi_{\tau} - {\chi_{\tau,\kappa,0}( {{\tau = 1},\ldots \mspace{20mu},{m;{\kappa = 0}},\ldots \mspace{14mu},f_{\tau}} )}}},\mspace{20mu} {{{for}\mspace{14mu} \tau} = 1},\ldots \mspace{14mu},m,{\kappa = 0},\ldots \mspace{20mu},f_{\tau},{\iota = 0},1,\mspace{20mu} {\mu^{({\tau,\kappa,0})}:={\deg ( {d_{\tau}(x)}^{\kappa} )}},{\mu^{({\tau,\kappa,1})}:={\deg ( {d_{\tau}(x)}^{f_{\tau} - \kappa} )}},\mspace{20mu} ( {{\kappa = 0},\ldots \mspace{14mu},f_{\tau}} ),{{a_{i,0}^{({\tau,\kappa})} + {a_{i,1}^{({\tau,\kappa})}x} + \ldots + {a_{i,{\mu^{({\tau,\kappa,0})} - 1}}^{({\tau,\kappa})}x^{\mu^{({\tau,\kappa,0})} - 1}}}:={{a_{i}(x)}{mod}\; {d_{\tau}(x)}^{\kappa}}},}} & \lbrack {{Formula}\mspace{14mu} 169} \rbrack \\{{{b_{i,0}^{({\tau,k})} + {b_{i,1}^{({\tau,\kappa})}x} + \ldots + {b_{i,{\mu^{({\tau,\kappa,1})} - 1}}^{({\tau,\kappa})}x^{\mu^{({\tau,\kappa,1})} - 1}}}:={{b_{i}(x)}{mod}\; {d_{\tau}(x)}^{f_{\tau} - \kappa}}},\mspace{20mu} {\delta_{j}^{({\tau,\kappa,\iota})}\overset{U}{}_{q}},( {{j = 0},\ldots \mspace{14mu},{\mu^{({\tau,\kappa,\iota})} - 1}} ),\mspace{20mu} {{{\overset{arrow}{\eta}}_{0}}^{({\tau,\kappa,\iota})}\overset{U}{}_{q}^{w_{0}}},\mspace{20mu} {s_{0}^{({\tau,\kappa,0})}:={\sum\limits_{j = 0}^{\mu^{({\tau,\kappa,0})} - 1}{\delta_{j}^{({\tau,\kappa,0})} \cdot a_{0,j}^{({\tau,\kappa})}}}},\mspace{20mu} {s_{0}^{({\tau,\kappa,1})}:={\sum\limits_{j = 0}^{\mu^{({\tau,\kappa,1})} - 1}{\delta_{j}^{({\tau,\kappa,1})} \cdot b_{0,j}^{({\tau,\kappa})}}}},} & \; \\{{k_{0}^{*{({\tau,\kappa,\iota})}}:={( {\overset{\overset{n_{0}}{}}{{s_{0}^{({\tau,\kappa,\iota})} + \pi_{\tau,\kappa,\iota}},}\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{0}}{}}{{\overset{arrow}{\eta}}_{0}^{({\tau,\kappa,\iota})},}\overset{\overset{z_{0}}{}}{0,\ldots \mspace{20mu},0,\chi_{\tau,\kappa,\iota}}} )_{0}^{*{({\tau,\kappa,\iota})}}}},\mspace{20mu} {{{for}\mspace{14mu} i} = 1},\ldots \mspace{14mu},L,} & \lbrack {{Formula}\mspace{14mu} 170} \rbrack \\{{\xi_{i,\tau,\iota}\overset{U}{}{_{q}( {{i = 1},\ldots \mspace{14mu},{L;{\tau = 1}},\ldots \mspace{14mu},{{m - 1};{\iota = 0}},1} )}},\mspace{20mu} {\xi_{i,\tau,\iota}:={- {\sum\limits_{\tau = 1}^{m - 1}{\xi_{i,\tau,\iota}( {{i = 1},\ldots \mspace{20mu},{L;{\iota = 0}},1} )}}}},\mspace{20mu} {s_{i}^{({\tau,\kappa,0})}:={{\sum\limits_{j = 0}^{\mu^{({\tau,\kappa,0})} - 1}{\delta_{j}^{({\tau,\kappa,0})} \cdot a_{i,j}^{({\tau,k})}}} + \xi_{i,\tau,0}}},\mspace{20mu} {s_{i}^{({\tau,\kappa,1})}:={{\sum\limits_{j = 0}^{\mu^{({\tau,\kappa,1})} - 1}{\delta_{j}^{({\tau,\kappa,1})} \cdot b_{i,j}^{({\tau,k})}}} + \xi_{i,\tau,1}}},\mspace{20mu} {{{if}\mspace{14mu} {\rho (i)}} = ( {t,v_{i}} )},{\theta_{i}\overset{U}{}_{q}},{{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{w_{t}}},{k_{i}^{*{({\tau,\kappa,\iota})}}:={( {\overset{\overset{n_{t}}{}}{{s_{i}^{({\tau,\kappa,\iota})} + {\theta_{i}v_{i}}},{- \theta_{i}},}\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{t}}{}}{{\overset{arrow}{\eta}}_{i},}\overset{\overset{z_{t}}{}}{0,\ldots \mspace{20mu},0}} )_{t}^{*{({\tau,\kappa,\iota})}}}},\mspace{20mu} {{{if}\mspace{14mu} {\rho (i)}} = {( {t,v_{i}} )}},{{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{w_{t}}},} & \; \\{{k_{i}^{*{({\tau,\kappa,\iota})}}:={( {\overset{\overset{n_{t}}{}}{{{s_{i}^{({\tau,\kappa,\iota})}v_{i}} - s_{i}^{({\tau,\kappa,\iota})}},}\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{t}}{}}{{\overset{arrow}{\eta}}_{i},}\overset{\overset{z_{t}}{}}{0,\ldots \mspace{20mu},0}} )_{t}^{*{({\tau,\kappa,\iota})}}}},\mspace{20mu} {{{if}\mspace{14mu} {\rho (i)}} = p_{0}},{{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{w_{0}}},\mspace{20mu} {k_{i}^{*{({\tau,\kappa,\iota})}}:={( {\overset{\overset{n_{0}}{}}{s_{i}^{({\tau,\kappa,\iota})},}\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{0}}{}}{{\overset{arrow}{\eta}}_{i},}\overset{\overset{z_{0}}{}}{0,\ldots \mspace{20mu},0}} )_{0}^{*{({\tau,\kappa,\iota})}}}},{{{return}\mspace{14mu} {sk}_{}}:={( {,\{ {k_{0}^{*{({\tau,\kappa,\iota})}},k_{1}^{*{({\tau,\kappa,\iota})}},\ldots \mspace{14mu},k_{L}^{*{({\tau,\kappa,\iota})}}} \}_{{\tau = 1},\; \ldots \mspace{11mu},{m;{\kappa = 0}},\; \ldots \mspace{11mu},{f_{\tau};{\iota = 0}},1}} ).}}} & \; \\{\mspace{79mu} {{{{Enc}( {{pk},{msg},{\Gamma:=\{ ( {t,x_{t}} ) \middle| {1 \leq t \leq d} \}}} )}\text{:}}\mspace{20mu} {\omega,{\zeta \overset{U}{}_{q}},\mspace{20mu} {{\overset{arrow}{\phi}}_{0}\overset{U}{}_{q}^{z_{0} - 1}},\mspace{20mu} {{{{\overset{arrow}{\phi}}_{t}\overset{U}{}_{q}^{z_{t}}}\mspace{14mu} {for}\mspace{14mu} ( {t,x_{t}} )} \in \Gamma},{c_{0}^{({t,\kappa,\iota})}:={( {\overset{\overset{n_{0}}{}}{\omega,0,\ldots \mspace{14mu},0,}\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0,}\mspace{14mu} \overset{\overset{w_{0}}{}}{0,\ldots \mspace{14mu},0,}\mspace{14mu} \overset{\overset{z_{0}}{}}{{\overset{arrow}{\phi}}_{0},\zeta}} )_{0}^{({\tau,\kappa,\iota})}}},}}} & \lbrack {{Formula}\mspace{14mu} 171} \rbrack \\{{c_{t}^{({t,\kappa,\iota})}:={( {\overset{\overset{n_{t}}{}}{{\omega ( {1,\; x_{t}} )},0,\ldots \mspace{14mu},0}\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0,}\mspace{14mu} \overset{\overset{w_{t}}{}}{0,\ldots \mspace{14mu},0,}\mspace{14mu} \overset{\overset{z_{t}}{}}{{\overset{arrow}{\phi}}_{t}}} )_{t}^{({\tau,\kappa,\iota})}}},\mspace{20mu} {{{for}\mspace{14mu} ( {t,x_{t}} )} \in \Gamma},\mspace{20mu} {c_{d + 1}:={g_{T}^{\zeta}{msg}}},\mspace{20mu} {{{return}\mspace{14mu} {ct}_{\Gamma}}:={( {\Gamma,c_{0},\{ c_{t} \}_{{({t,x_{t}})} \in \Gamma},c_{d + 1}} ).}}} & \;\end{matrix}$

Likewise, the CP-FE scheme indicated in Formulas 165 to 167 can bealtered to the attribute-based encryption scheme.

In the above explanation, n₀+u₀+w₀+z₀ is set in N₀ andn_(t)+u_(t)+w_(t)+z_(t) is set in N_(t). If, for example, u₀=n₀, w₀=n₀,and z₀=2, then n₀+n₀+n₀+2=3n₀+2 (n₀=1 and accordingly N₀=5) may be setin N₀. If u_(t)=n_(t), w_(t)=n_(t), and z_(t)=1, thenn_(t)+n_(t)+n_(t)+1=3n_(t)+1 may be set in N_(t).

Embodiment 4

In Embodiments 2 and 3, for each polynomial d_(τ)(x)^(fτ) obtained byfactorizing the target polynomial d(x), an element which is a remainderof dividing a polynomial a_(i)(x) by a polynomial d_(τ)(x)^(κ) and anelement which is a remainder of dividing a polynomial b_(i)(x) by apolynomial d_(τ)(x)^(fτ-κ) are treated as key elements.

In Embodiment 4, for each polynomial d_(Γ)(x)^(fτ) obtained byfactorizing the target polynomial d(x), an element obtained bysubstituting a random value γ into a polynomial d_(τ)(x)^(κ) and anelement obtained by substituting the random value γ into a polynomiald_(τ)(x)^(fτ-κ) are treated as key elements.

The configurations of a key generation device 100, an encryption device200, and a decryption device 300 according to Embodiment 4 arerespectively the same as the configurations of the key generation device100, the encryption device 200, and the decryption device 300 accordingto Embodiment 2 shown in FIGS. 5 and 7.

The processes of a Setup algorithm and Enc algorithm according toEmbodiment 4 are the same as the processes of the Setup algorithm andEnc algorithm according to Embodiment 2.

The process flow of the Dec algorithm according to Embodiment 4 is thesame as the process flow of the Dec algorithm according to Embodiment 2shown in FIG. 11.

FIG. 12 is a flowchart showing the process of the KeyGen algorithmaccording to Embodiment 4.

The process of the KeyGen algorithm will be described with reference toFIG. 12.

The processes of (S501) through (S503) are the same as the processes of(S201) to (S203) shown in FIG. 9, and the process of (S505) is the sameas the process of (S206) shown in FIG. 9.

(S504: Key Element Generation Step)

With the processing device, concerning each integer τ of τ=1 . . . , m,each integer κ of x=0, f each integer ι of ι=0, 1, and each integer j ofj=1, . . . , μ+1, a key element generation part 142 generates elementsk*_(0,j) ^((τ,κ,ι)) and k*_(0,μ+1) ^((τ,κ,ι)) of a decryption keysk_(s), as indicated in Formula 172.

$\begin{matrix}{\mspace{79mu} {{\gamma \overset{U}{}_{q}},{\overset{arrow}{\eta}}_{0,0},\ldots \mspace{20mu},{{\overset{arrow}{\eta}}_{0,{\mu + 1}}\overset{U}{}_{q}^{w_{0}}},{k_{0,j}^{*{({\tau,\kappa,0})}}:={( {\overset{\overset{n_{0}}{}}{{\delta ( {{\gamma^{j} \cdot {d_{\tau}(\gamma)}^{\kappa}},{\overset{arrow}{}}_{0,j}^{({\tau,\kappa,0})}} )},}\overset{\overset{u_{0}}{}}{0,\ldots \mspace{11mu},0,}\overset{\overset{w_{0}}{}}{{\overset{arrow}{\eta}}_{0,j},}\overset{\overset{z_{0}}{}}{0,{\ldots \mspace{14mu} 0}}} )_{0}^{*}}},{k_{0,j}^{*{({\tau,\kappa,1})}}:={( {\overset{\overset{n_{0}}{}}{{\delta ( {{\gamma^{j} \cdot {d_{\tau}(\gamma)}^{f_{\tau} - \kappa}},{\overset{arrow}{}}_{0,j}^{({\tau,\kappa,1})}} )},}\overset{\overset{u_{0}}{}}{0,\ldots \mspace{11mu},0,}\overset{\overset{w_{0}}{}}{{\overset{arrow}{\eta}}_{0,j},}\overset{\overset{z_{0}}{}}{0,{\ldots \mspace{14mu} 0}}} )_{0}^{*}}},\mspace{20mu} {s_{0}:={{{- {a_{0}(\gamma)}}\mspace{14mu} {if}\mspace{14mu} \iota} = 0}},{s_{0}:={{{- {b_{0}(\gamma)}}\mspace{14mu} {if}\mspace{14mu} \iota} = 1}},{k_{0,{\mu + 1}}^{*{({\tau,\kappa,\iota})}}:={( {\overset{\overset{n_{0}}{}}{{\delta ( {{s_{0} + \pi_{\tau,\kappa,\iota}},{\overset{arrow}{}}_{0,{\mu + 1}}^{({\tau,\kappa,\iota})}} )},}\overset{\overset{u_{0}}{}}{0,\ldots \mspace{11mu},0,}\overset{\overset{w_{0}}{}}{{\overset{arrow}{\eta}}_{0,{\mu + 1}},}\overset{\overset{z_{0}}{}}{0,{\ldots \mspace{14mu} 0},\chi_{\tau,\kappa,\iota}}} )_{0}^{*}}}}} & \lbrack {{Formula}\mspace{14mu} 172} \rbrack\end{matrix}$

With the processing device, concerning each integer τ of τ=1 . . . , m,each integer κ of κ=0, . . . , f_(τ), each integer ι of ι=0, 1, and eachinteger i of i=1, . . . , L, the key element generation part 142generates an element k*_(i) ^((τ,κ,ι)) of the decryption key sk asindicated in Formula 173.

$\begin{matrix}{{\xi_{i,\tau,\iota}\overset{U}{}{_{q}( {{i = 1},\ldots \mspace{14mu},{L;{\tau = 1}},\ldots \mspace{14mu},{{m - 1};{\iota = 0}},1} )}},\mspace{20mu} {\xi_{i,\tau,\iota}:={- {\sum\limits_{\tau = 1}^{m - 1}{\xi_{i,\tau,\iota}( {{i = 1},\ldots \mspace{20mu},{L;{\iota = 0}},1} )}}}},\mspace{20mu} {s_{i}:={{{- {a_{i}(\gamma)}} + {\xi_{i,\tau,0}\mspace{14mu} {if}\mspace{14mu} \iota}} = 0}},\mspace{20mu} {s_{i}:={{{- {b_{i}(\gamma)}} + {\xi_{i,\tau,1}\mspace{14mu} {if}\mspace{14mu} \iota}} = 1}},\mspace{20mu} {{{if}\mspace{14mu} {\rho (i)}} = ( {t,{\overset{arrow}{v}}_{i}} )},{\theta_{i}\overset{U}{}_{q}},{{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{w_{t}}},{k_{i}^{*{({\tau,\kappa,\iota})}}:={( {\overset{\overset{n_{t}}{}}{{\delta ( {{s_{i}{\overset{arrow}{e}}_{1}} + {\theta_{i}{\overset{arrow}{v}}_{i}}} )},{\overset{arrow}{e}}_{i}^{({\tau,\kappa,\iota})},}\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{t}}{}}{{\overset{arrow}{\eta}}_{i},}\overset{\overset{z_{t}}{}}{0,\ldots \mspace{20mu},0}} )_{t}^{*}}},\mspace{20mu} {{{if}\mspace{14mu} {\rho (i)}} = {( {t,{\overset{arrow}{v}}_{i}} )}},{{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{w_{t}}},\mspace{79mu} {k_{i}^{*{({\tau,\kappa,\iota})}}:={( {\overset{\overset{n_{t}}{}}{{\delta \; s_{i}{\overset{arrow}{v}}_{i}},{\overset{arrow}{e}}_{i}^{({\tau,\kappa,\iota})},}\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{t}}{}}{{\overset{arrow}{\eta}}_{i},}\overset{\overset{z_{t}}{}}{0,\ldots \mspace{20mu},0}} )_{t}^{*}}},} & \lbrack {{Formula}\mspace{14mu} 173} \rbrack\end{matrix}$

Note that e^(→) _(0,j) ^((τ,κ,ι)) (j=1, . . . , μ+1) is a2mf_(max)-dimensional vector in which 1 is set as the coefficient forone basis vector and 0 is set as the coefficient for another basisvector, and the basis vector for which 1 is set as the coefficient isdifferent for each (τ,κ,ι).

In brief, from (S501) through (S504), the key generation device 100generates the decryption key sk_(s) by executing the KeyGen algorithmindicated in Formulas 174 to 175. Then, in (S505), the key generationdevice 100 distributes the generated decryption key sk_(s) to thedecryption device 300.

$\begin{matrix}{{{{KeyGen}( {{pk},{sk},{:=( {,\mathcal{B},{{d(x)} = {\prod\limits_{\tau = 1}^{m}\; {d_{\tau}(x)}^{f_{\tau}}}},\rho} )}} )}\text{:}}\mspace{20mu} {{\pi_{\tau}\overset{U}{}_{q}},( {{\tau = 1},\ldots \mspace{14mu},{m - 1}} ),{\pi_{m}:={- {\sum\limits_{\tau = 1}^{m - 1}\pi_{\tau}}}},\mspace{79mu} {\pi_{\tau,\kappa,0}\overset{U}{}_{q}},}} & \lbrack {{Formula}\mspace{14mu} 174} \rbrack \\{{\pi_{\tau,\kappa,1}:={\pi_{\tau} - {\pi_{\tau,\kappa,0}( {{\tau = 1},\ldots \mspace{14mu},{m;{\kappa = 0}},\ldots \mspace{14mu},f_{\tau}} )}}},\mspace{20mu} {\chi_{\tau}\overset{U}{}_{q}},( {{\tau = 1},\ldots \mspace{14mu},{m - 1}} ),{\chi_{m}:={1 - {\sum\limits_{\tau = 1}^{m - 1}\chi_{\tau}}}},\mspace{79mu} {\chi_{\tau,\kappa,0}\overset{U}{}_{q}},{\chi_{\tau,\kappa,1}:={\chi_{\tau} - {\chi_{\tau,\kappa,0}( {{\tau = 1},\ldots \mspace{20mu},{m;{\kappa = 0}},\ldots \mspace{14mu},f_{\tau}} )}}},\mspace{20mu} {{{for}\mspace{14mu} \tau} = 1},\ldots \mspace{14mu},m,{\kappa = 0},\ldots \mspace{20mu},f_{\tau},{\iota = 0},1,\mspace{20mu} {\gamma \overset{U}{}_{q}},{\overset{arrow}{\eta}}_{0,0},\ldots \mspace{14mu},{{\overset{arrow}{\eta}}_{0,{\mu + 1}}\overset{U}{}_{q}^{w_{0}}},\mspace{20mu} {{{for}\mspace{14mu} j} = 0},\ldots \mspace{14mu},\mu,} & \; \\{{k_{0,j}^{*{({\tau,\kappa,0})}}:={( {\overset{\overset{n_{0}}{}}{{\delta ( {{\gamma^{j} \cdot {d_{\tau}(\gamma)}^{\kappa}},{\overset{arrow}{e}}_{0,j}^{({\tau,\kappa,0})}} )},}\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{0}}{}}{{\overset{arrow}{\eta}}_{0,j},}\overset{\overset{z_{0}}{}}{0,\ldots \mspace{20mu},0}} )_{0}^{*}}},{k_{0,j}^{*{({\tau,\kappa,1})}}:={( {\overset{\overset{n_{0}}{}}{{\delta ( {{\gamma^{j} \cdot {d_{\tau}(\gamma)}^{f_{\tau} - \kappa}},{\overset{arrow}{e}}_{0,j}^{({\tau,\kappa,1})}} )},}\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{0}}{}}{{\overset{arrow}{\eta}}_{0,j},}\overset{\overset{z_{0}}{}}{0,\ldots \mspace{20mu},0}} )_{0}^{*}}},\mspace{20mu} {s_{0}:={{{- {a_{0}(\gamma)}}\mspace{14mu} {if}\mspace{14mu} \iota} = 0}},{s_{0}:={{{- {b_{0}(\gamma)}}\mspace{14mu} {if}\mspace{14mu} \iota} = 1}},{k_{0,{\mu + 1}}^{*{({\tau,\kappa,\iota})}}:={( {\overset{\overset{n_{0}}{}}{{\delta ( {{x_{0} + \pi_{\tau,\kappa,\iota}},{\overset{arrow}{e}}_{0,{\mu + 1}}^{({\tau,\kappa,\iota})}} )},}\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{0}}{}}{{\overset{arrow}{\eta}}_{0,{\mu + 1}},}\overset{\overset{z_{0}}{}}{0,{\ldots \mspace{14mu} 0},\chi_{\tau,\kappa,\iota}}} )_{0}^{*}}},} & \; \\{{{{for}\mspace{14mu} i} = 1},\ldots \mspace{14mu},L,{\xi_{i,\tau,\iota}\overset{U}{}{_{q}( {{i = 1},\ldots \mspace{14mu},{L;{\tau = 1}},\ldots \mspace{14mu},{{m - 1};{\iota = 0}},1} )}},\mspace{20mu} {\xi_{i,m,\iota}:={- {\sum\limits_{\tau = 1}^{m - 1}{\xi_{i,\tau,\iota}( {{i = 1},\ldots \mspace{20mu},{L;{\iota = 0}},1} )}}}},\mspace{20mu} {s_{i}:={{{- {a_{i}(\gamma)}} + {\xi_{i,\tau,0}\mspace{14mu} {if}\mspace{14mu} \iota}} = 0}},\mspace{20mu} {s_{i}:={{{- {b_{i}(\gamma)}} + {\xi_{i,\tau,1}\mspace{14mu} {if}\mspace{14mu} \iota}} = 1}},\mspace{20mu} {{{if}\mspace{14mu} {\rho (i)}} = ( {t,{\overset{arrow}{v}}_{i}} )},{\theta_{i}\overset{U}{}_{q}},{{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{w_{t}}},} & \lbrack {{Formula}\mspace{14mu} 175} \rbrack \\{{k_{i}^{*{({\tau,\kappa,\iota})}}:={( {\overset{\overset{n_{t}}{}}{{\delta ( {{s_{i}{\overset{arrow}{e}}_{1}} + {\theta_{i}{\overset{arrow}{v}}_{i}}} )},{\overset{arrow}{e}}_{i}^{({\tau,\kappa,\iota})},}\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{t}}{}}{{\overset{arrow}{\eta}}_{i},}\overset{\overset{z_{t}}{}}{0,\ldots \mspace{20mu},0}} )_{t}^{*}}},\mspace{20mu} {{{if}\mspace{14mu} {\rho (i)}} = {( {t,{\overset{arrow}{v}}_{i}} )}},{{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{w_{t}}},\mspace{79mu} {k_{i}^{*{({\tau,\kappa,\iota})}}:={( {\overset{\overset{n_{t}}{}}{{\delta \; s_{i}{\overset{arrow}{v}}_{i}},{\overset{arrow}{e}}_{i}^{({\tau,\kappa,\iota})},}\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{t}}{}}{{\overset{arrow}{\eta}}_{i},}\overset{\overset{z_{t}}{}}{0,\ldots \mspace{20mu},0}} )_{t}^{*}}},{{{return}\mspace{14mu} {sk}_{}}:=( {,{\{ {k_{0,0}^{*{({\tau,\kappa,\iota})}},\ldots \mspace{14mu},k_{0,{\mu + 1}}^{*{({\tau,\kappa,\iota})}},k_{1}^{*{({\tau,\kappa,\iota})}},\ldots \mspace{14mu}, \quad k_{L}^{*{({\tau,\kappa,\iota})}} \}_{{\tau = 1},\; \ldots \mspace{11mu},{m;{\kappa = 0}},\; \ldots \mspace{11mu},{f_{\tau};{\iota = 0}},1}} ).}} }} & \;\end{matrix}$

The process of the Dec algorithm will be described with reference toFIG. 11.

The processes of (S401) through (S404) are the same as those inEmbodiment 2.

(S405: Coefficient Calculation Step)

With the processing device, a coefficient calculation part 332 of acomplementary coefficient calculation part 330 calculates coefficients(α₁, . . . , α_(L)), coefficients (β_(i), . . . , β_(L)), and a degree xwith which Formula 176 is established.

h _(τ,κ,0)(x)·d _(τ)(x)^(κ) =a ₀(x)+Σ_(i=1) ^(L)α_(i) a _(i)(x), and

h _(τ,κ,1)(x)·d _(τ)(x)^(ƒ) ^(τ) ^(-κ) =b ₀(x)+Σ_(i=1) ^(L)β_(i) b_(i)(x)  [Formula 176]

Note that α_(i)=0=β_(i) concerning all i not included in I_((ρ,Γ)).Also, h_(τ,κ,ι)(x):=h_(τ,κ,ι,0)+h_(τ,κ,ι,1)x+ . . . h_(τ,κ,ι,μ)x^(μ)concerning all integers T of T=m and all integers t of ι=0, 1.

(S406: Pairing Operation Step)

A pairing operation part 341 of a decryption part 340 generates sessionkeys K_(τ,0) and K_(τ,1) by calculating Formula 177 with the processingdevice.

$\begin{matrix}{{{{K_{\tau,0}:={{e( {c_{0},{\sum\limits_{j = 0}^{\mu}{h_{\tau,\kappa,0,j}k_{0,j}^{*{({\tau,\kappa,0})}}}}} )} \cdot {e( {c_{0},k_{0,{\mu + 1}}^{*{({\tau,\kappa,0})}}} )} \cdot {\prod\limits_{{i \in I_{\delta}}, +}\; {{e( {c_{t},k_{i}^{*{({\tau,\kappa,0})}}} )}{\alpha_{i} \cdot {\prod\limits_{{i \in I_{\delta}}, -}\; {{e( {c_{t},k_{i}^{*{({\tau,\kappa,0})}}} )}{\alpha_{i}/( {{\overset{arrow}{v}}_{i} \cdot {\overset{arrow}{x}}_{t}} )}}}}}}}},{K_{\tau,1}:={{e( {c_{0},{\sum\limits_{j = 0}^{\mu}{h_{\tau,\kappa,1,j}k_{0,j}^{*{({\tau,\kappa,1})}}}}} )} \cdot {e( {c_{0},k_{0,{\mu + 1}}^{*{({\tau,\kappa,1})}}} )} \cdot {\prod\limits_{{i \in I_{\delta}}, +}\; {{e( {c_{t},k_{i}^{*{({\tau,\kappa,1})}}} )}{\beta_{i} \cdot {\prod\limits_{{i \in I_{\delta}}, -}\; {{e( {c_{t},k_{i}^{*{({\tau,\kappa,1})}}} )}{\beta_{i}/( {{\overset{arrow}{v}}_{i} \cdot {\overset{arrow}{x}}_{t}} )}}}}}}}},\mspace{20mu} {{{where}\mspace{14mu} I_{\delta, +}}:={\{ { {i \in I_{\delta}} \middle| {\rho (i)}  = ( {t,{\overset{arrow}{v}}_{i}} )} \} \mspace{14mu} {and}}}}\mspace{20mu} {I_{\delta, -}:=\{ { {i \in I_{\delta}} \middle| {\rho (i)}  = {( {t,{\overset{arrow}{v}}_{i}} )}} \}}}\mspace{14mu}} & \lbrack {{Formula}\mspace{14mu} 177} \rbrack\end{matrix}$

(S407: Message Calculation Step)

A message calculation part 342 generates a message msg′ (=msg) bycalculating Formula 178 with the processing device.

$\begin{matrix}{{msg}^{\prime}:={c_{d + 1}/( {\prod\limits_{\tau = 1}^{m}\; {K_{\tau,0}K_{\tau,1}}} )}} & \lbrack {{Formula}\mspace{14mu} 178} \rbrack\end{matrix}$

Note that by calculating Formula 177, g_(T) ^(ζ) can be obtained, asindicated in Formula 179. Hence, by calculating Formula 178, the messagemsg′ (=msg) m can be obtained.

$\begin{matrix}{{K_{\tau,0}:={{{e( {c_{0},{\sum\limits_{j = 0}^{\mu}{h_{\tau,\kappa,0,j}k_{0,j}^{*{({\tau,\kappa,0})}}}}} )} \cdot {e( {c_{0},k_{0,{\mu + 1}}^{*{({\tau,\kappa,0})}}} )} \cdot {\prod\limits_{{i \in I_{\delta}}, +}\; {{e( {c_{t},k_{i}^{*{({\tau,\kappa,0})}}} )}^{\alpha_{i}} \cdot {\prod\limits_{{i \in I_{\delta}}, -}\; {{e( {c_{t},k_{i}^{*{({\tau,\kappa,0})}}} )}{\alpha_{i}/( {{\overset{arrow}{v}}_{i} \cdot {\overset{arrow}{x}}_{t}} )}}}}}} = {{g_{T}^{{\delta\omega}{({\sum\limits_{j = 0}^{\mu}{h_{\tau,\kappa,0,j}{\gamma^{j} \cdot {d_{\tau}{(\gamma)}}^{\kappa}}}})}} \cdot g_{T}^{{{\delta\omega}{({{- {a_{0}{(\gamma)}}} + \pi_{\tau,\kappa,0}})}} + {\zeta\chi}_{\tau,\kappa,0}} \cdot g_{T}^{{\delta\omega}{\sum\limits_{i = 1}^{L}{({{{- \alpha_{i}}{\alpha_{i}{(\gamma)}}} + {\alpha_{i}\xi_{i,\tau,0}}})}}}} = {{g_{T}^{{\delta\omega}\; {{h_{\tau,\kappa,0}{(\gamma)}} \cdot {d_{\tau}{(\gamma)}}^{\kappa}}} \cdot g_{T}^{- {{\delta\omega}{({{a_{0}{(\gamma)}} + {\sum_{i = 1}^{L}{\alpha_{i}{\alpha_{i}{(\gamma)}}}}})}}} \cdot g_{T}^{{\delta\omega\pi}_{\tau,\kappa,0} + {\zeta\chi}_{\tau,\kappa,0} + {\sum_{i = 1}^{L}{\alpha_{i}\xi_{i,\tau,0}}}}} = g_{T}^{{\delta\omega\pi}_{\tau,\kappa,0} + {\zeta\chi}_{\tau,\kappa,0} + {\sum_{i = 1}^{L}{\alpha_{i}\xi_{i,\tau,0}}}}}}}}{K_{\tau,1} = {{g_{T}^{{\delta\omega\pi}_{\tau,\kappa,1} + {\zeta\chi}_{\tau,\kappa,1} + {\sum_{i = 1}^{L}{\beta_{i}\xi_{i,\tau,1}}}}{\prod\limits_{\tau = 1}^{m}\; {K_{\tau,0}K_{\tau,1}}}} = {g_{T}^{\sum\limits_{\tau = 1}^{m}{({{{\delta\omega}{({\pi_{\tau,\kappa,0} + \pi_{\tau,\kappa,1}})}} + {\zeta {({\chi_{\tau,\kappa,0} + \chi_{\tau,\kappa,1}})}} + {\sum\limits_{i = 1}^{L}{({{\alpha_{i}\xi_{i,\tau,0}} + {\beta_{i}\xi_{i,\tau,1}}})}}})}} = {g_{T}^{{\omega {\sum\limits_{\tau = 1}^{m}\pi_{\tau}}} + {\zeta {\sum\limits_{\tau = 1}^{m}\chi_{\tau}}} + {\omega {\sum\limits_{i = 1}^{L}{\alpha_{i}{({\sum\limits_{\tau = 1}^{m}\xi_{i,\tau,0}})}}}} + {\omega {\sum\limits_{i = 1}^{L}{\beta_{i}{({\sum\limits_{\tau = 1}^{m}\xi_{i,\tau,1}})}}}}} = g_{T}^{\zeta}}}}}} & \lbrack {{Formula}\mspace{14mu} 179} \rbrack\end{matrix}$

In brief, from (S401) through (S407), the decryption device 300generates the message msg′ (=msg) by executing the Dec algorithmindicated in Formula 180.

$\begin{matrix}{{Dec}( {{pk},{{sk}_{}:={{ \quad{( {,\begin{Bmatrix}{k_{0,0}^{*{({\tau,\kappa,\iota})}},\ldots \mspace{14mu},k_{0,{\mu + 1}}^{*{({\tau,\kappa,\iota})}},} \\{k_{1}^{*{({\tau,\kappa,\iota})}},\ldots \mspace{14mu},} \\k_{L}^{*{({\tau,\kappa,\iota})}}\end{Bmatrix}_{{\tau = 1},\; \ldots \mspace{11mu},{m;{\kappa = 0}},\; {{\ldots \mspace{11mu} f_{\tau}};{\iota = 0}},1}} ),\mspace{20mu} {{ct}_{\Gamma}:=( {\Gamma,c_{0},\{ c_{t} \}_{{({t,{\overset{arrow}{x}}_{t}})} \in \Gamma},c_{d + 1}} )}} ):\mspace{79mu} {{if}\mspace{14mu} }}:={{( {,\mathcal{B},{d(x)},\rho} )\mspace{14mu} {accepts}\mspace{14mu} \Gamma}:=\{ ( {t,{\overset{arrow}{x}}_{t}} ) \}}}},{{{then}\mspace{14mu} {compute}\mspace{14mu} I_{\delta}} \subseteq \{ {1,\ldots \mspace{14mu},L} \}},( {\alpha_{1},\ldots \mspace{14mu},\alpha_{L}} ),{{( {\beta_{1},\ldots \mspace{14mu},\beta_{L}} )\mspace{14mu} {and}\mspace{20mu} {\kappa \mspace{14mu} {with}\mspace{14mu} {h_{\tau,\kappa,\iota}(x)}}}:={h_{\tau,\kappa,\iota,0} + {h_{\tau,\kappa,\iota,1}x} + \ldots + {h_{\tau,\kappa,\iota,\mu}x^{\mu}\mspace{20mu} {{{for}\mspace{14mu} {all}\mspace{14mu} \tau} = 1}}}},\ldots \mspace{14mu},{{m\mspace{14mu} {and}\mspace{14mu} \iota} = 0},{1\mspace{14mu} {such}\mspace{14mu} {that}\mspace{20mu} {{{h_{\tau,\kappa,0}(x)} \cdot {d_{\tau}(x)}^{\kappa}} = {{a_{0}(x)} + {\sum\limits_{i = 1}^{L}{\alpha_{i}{\alpha_{i}(x)}}}}}},{{and}\mspace{20mu} {{{{h_{\tau,\kappa,1}(x)} \cdot {d_{\tau}(x)}}f_{\tau}^{- \kappa}} = {{b_{0}(x)} + {\sum\limits_{i = 1}^{L}{\beta_{i}{b_{i}(x)}}}}}},{K_{\tau,0}:={{e( {c_{0},{\sum\limits_{j = 0}^{\mu}{h_{\tau,\kappa,0,j}k_{0,j}^{*{({\tau,\kappa,0})}}}}} )} \cdot {e( {c_{0},k_{0,{\mu + 1}}^{*{({\tau,\kappa,0})}}} )} \cdot {\prod\limits_{{i \in I_{\delta}}, +}\; {{e( {c_{t},k_{i}^{*{({\tau,\kappa,0})}}} )}{\alpha_{i} \cdot {\prod\limits_{{i \in I_{\delta}}, -}\; {{e( {c_{t},k_{i}^{*{({\tau,\kappa,0})}}} )}{\alpha_{i}/( {{\overset{arrow}{v}}_{i} \cdot {\overset{arrow}{x}}_{t}} )}}}}}}}},{K_{\tau,1}:={{e( {c_{0},{\sum\limits_{j = 0}^{\mu}{h_{\tau,\kappa,1,j}k_{0,j}^{*{({\tau,\kappa,1})}}}}} )} \cdot {e( {c_{0},k_{0,{\mu + 1}}^{*{({\tau,\kappa,1})}}} )} \cdot {\prod\limits_{{i \in I_{\delta}}, +}\; {{e( {c_{t},k_{i}^{*{({\tau,\kappa,1})}}} )}{\beta_{i} \cdot {\prod\limits_{{i \in I_{\delta}}, -}\; {{e( {c_{t},k_{i}^{*{({\tau,\kappa,1})}}} )}{\beta_{i}/( {{\overset{arrow}{v}}_{i} \cdot {\overset{arrow}{x}}_{t}} )}}}}}}}},\mspace{20mu} {{{where}\mspace{14mu} I_{\delta, +}}:={{\{ { {i \in I_{\delta}} \middle| {\rho (i)}  = ( {t,{\overset{arrow}{v}}_{i}} )} \} \mspace{14mu} {and}\mspace{20mu} I_{\delta, -}}:={{{\{ { {i \in I_{\delta}} \middle| {\rho (i)}  = {( {t,{\overset{arrow}{v}}_{i}} )}} \}.\mspace{11mu} \mspace{20mu} {return}}\mspace{14mu} {msg}^{\prime}}:={c_{d + 1}/{( {\prod\limits_{\tau = 1}^{m}\; {K_{\tau,0}K_{\tau,1}}} ).}}}}}} } & \lbrack {{Formula}\mspace{14mu} 180} \rbrack\end{matrix}$

As described above, a cryptographic system 10 according to Embodiment 4implements the functional encryption scheme by treating the elementobtained by substituting the random value γ into the polynomiald_(τ)(x)^(κ) and the element obtained by substituting the random value γinto the polynomial d_(τ)(x)^(fτ-κ), as key elements.

The KP-FE scheme has been described above. If the KeyGen algorithm, Encalgorithm, and Dec algorithm are modified as indicated in Formulas 181to 184, the CP-FE scheme may be realized. Note that the Setup algorithmis the same between the KP-FE scheme and the CP-FE scheme.

$\begin{matrix}{\mspace{79mu} {{{{KeyGen}( {{pk},{sk},{\Gamma:=\{ ( {t,{\overset{arrow}{x}}_{t}} ) \middle| {1 \leq t \leq d} \}}} )}\text{:}}\mspace{20mu} {{\omega \overset{U}{}_{q}},\mspace{20mu} {{\overset{arrow}{\phi}}_{0}\overset{U}{}_{q}^{w_{0}}},\mspace{20mu} {{{{\overset{arrow}{\phi}}_{t}\overset{U}{}_{q}^{w_{t}}}\mspace{14mu} {for}\mspace{14mu} ( {t,{\overset{arrow}{x}}_{t}} )} \in \Gamma},{k_{0}^{*}:={( {\overset{\overset{n_{0}}{}}{\omega,0,\ldots \mspace{14mu},0,}\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0,}\mspace{14mu} \overset{\overset{w_{0}}{}}{{\overset{arrow}{\phi}}_{0},}\mspace{14mu} \overset{\overset{z_{0}}{}}{0,\ldots \mspace{14mu},0,1}} )_{0}^{*}}},\mspace{20mu} {k_{t}^{*}:={( {\overset{\overset{n_{t}}{}}{{\omega \; {\overset{arrow}{x}}_{t}},0,\ldots \mspace{14mu},0}\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0,}\mspace{14mu} \overset{\overset{w_{t}}{}}{{\overset{arrow}{\phi}}_{t},}\mspace{14mu} \overset{\overset{z_{t}}{}}{0,\ldots \mspace{14mu},0}} )_{t}^{*}}},\mspace{20mu} {{{for}\mspace{14mu} ( {t,{\overset{arrow}{x}}_{t}} )} \in \Gamma},\mspace{20mu} {{{return}\mspace{14mu} {sk}_{\Gamma}}:={( {\Gamma,k_{0}^{*},\{ k_{t}^{*} \}_{{({t,{\overset{arrow}{x}}_{t}})} \in \Gamma}} ).}}}}} & \lbrack {{Formula}\mspace{14mu} 181} \rbrack \\{{{{Enc}( {{pk},{msg},{:=( {,\mathcal{B},{{d(x)} = {\prod\limits_{\tau = 1}^{m}\; {d_{\tau}(x)}^{f_{\tau}}}},\rho} )}} )}\text{:}}\mspace{20mu} {{\pi_{\tau}\overset{U}{}_{q}},( {{\tau = 1},\ldots \mspace{14mu},{m - 1}} ),{\pi_{m}:={- {\sum\limits_{\tau = 1}^{m - 1}\pi_{\tau}}}},\mspace{79mu} {\pi_{\tau,\kappa,0}\overset{U}{}_{q}},}} & \lbrack {{Formula}\mspace{14mu} 182} \rbrack \\{{{\pi_{\tau,\kappa,1}:={\pi_{\tau} - {\pi_{\tau,\kappa,0}( {{\tau = 1},\ldots \mspace{14mu},{m;{\kappa = 0}},\ldots \mspace{14mu},f_{\tau}} )}}},\mspace{20mu} {\chi_{\tau}\overset{U}{}_{q}},( {{\tau = 1},\ldots \mspace{14mu},{m - 1}} ),{\chi_{m}:={1 - {\sum\limits_{\tau = 1}^{m - 1}\chi_{\tau}}}},\mspace{79mu} {\chi_{\tau,\kappa,0}\overset{U}{}_{q}},{\chi_{\tau,\kappa,1}:={\chi_{\tau} - {\chi_{\tau,\kappa,0}( {{\tau = 1},\ldots \mspace{20mu},{m;{\kappa = 0}},\ldots \mspace{14mu},f_{\tau}} )}}},\mspace{79mu} {{{for}\mspace{14mu} \tau} = 1},\ldots \mspace{14mu},m,{\kappa = 0},\ldots \mspace{14mu},f_{\tau},{\iota = 0},1,\mspace{79mu} {\gamma \overset{U}{}_{q}},{\overset{arrow}{\eta}}_{0,0},\ldots \mspace{20mu},{{\overset{arrow}{\eta}}_{0,\mu}\overset{U}{}_{q}^{z_{0}}},{{\overset{arrow}{\eta}}_{0,{\mu + I}}\overset{U}{}_{q}^{z_{0} - 1}}}\mspace{20mu} {{{{for}\mspace{14mu} j} = 0},\ldots \mspace{14mu},\mu,}} & \; \\{{c_{0,j}^{({\tau,\kappa,0})}:={( {\overset{\overset{n_{0}}{}}{{\delta ( {{\gamma^{j} \cdot {d_{\tau}(\gamma)}^{\kappa}},{\overset{arrow}{e}}_{0}^{({\tau,\kappa,0})}} )},}\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{z_{0}}{}}{{\overset{arrow}{\eta}}_{0,j}}} )_{0}}},{c_{0,j}^{({\tau,\kappa,1})}:={( {\overset{\overset{n_{0}}{}}{{\delta ( {{\gamma^{j} \cdot {d_{\tau}(\gamma)}^{f_{\tau} - \kappa}},{\overset{arrow}{e}}_{0}^{({\tau,\kappa,1})}} )},}\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{z_{0}}{}}{{\overset{arrow}{\eta}}_{0,j}}} )_{0}}},\mspace{20mu} {s_{0}:={{{- {a_{0}(\gamma)}}\mspace{14mu} {if}\mspace{14mu} \iota} = 0}},{s_{0}:={{{- {b_{0}(\gamma)}}\mspace{14mu} {if}\mspace{14mu} \iota} = 1}},{c_{0,{\mu + 1}}^{({\tau,\kappa,\iota})}:={( {\overset{\overset{n_{0}}{}}{{\delta ( {{s_{0} + \pi_{\tau,\kappa,\iota}},{\overset{arrow}{e}}_{0}^{({\tau,\kappa,\iota})}} )},}\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{0}}{}}{0,{\ldots \mspace{14mu} 0},,}\overset{\overset{z_{0}}{}}{{\overset{arrow}{\eta}}_{0,{\mu + 1}},{\zeta\chi}_{\tau,\kappa,\iota}}} )_{0}}},} & \; \\{\mspace{79mu} {{{{for}\mspace{14mu} i} = 1},\ldots \mspace{14mu},L,{\xi_{i,\tau,\iota}\overset{U}{}{_{q}( {{i = 1},\ldots \mspace{14mu},{L;{\tau = 1}},\ldots \mspace{14mu},{{m - 1};{\iota = 0}},1} )}},\mspace{20mu} {\xi_{i,m,\iota}:={- {\sum\limits_{\tau = 1}^{m - 1}{\xi_{i,\tau,\iota}( {{i = 1},\ldots \mspace{20mu},{L;{\iota = 0}},1} )}}}},\mspace{20mu} {s_{i}:={{{- {a_{i}(\gamma)}} + {\xi_{i,\tau,0}\mspace{14mu} {if}\mspace{14mu} \iota}} = 0}},\mspace{20mu} {s_{i}:={{{- {b_{i}(\gamma)}} + {\xi_{i,\tau,1}\mspace{14mu} {if}\mspace{14mu} \iota}} = 1}},\mspace{20mu} {{{if}\mspace{14mu} {\rho (i)}} = ( {t,{\overset{arrow}{v}}_{i}} )},{\theta_{i}\overset{U}{}_{q}},{{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{z_{t}}},}} & \lbrack {{Formula}\mspace{14mu} 183} \rbrack \\{{c_{i}^{({\tau,\kappa,\iota})}:={( {\overset{\overset{n_{t}}{}}{{\delta ( {{s_{i}{\overset{arrow}{e}}_{1}} + {\theta_{i}{\overset{arrow}{v}}_{i}}} )},{\overset{arrow}{e}}_{i}^{({\tau,\kappa,\iota})},}\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{t}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{z_{t}}{}}{{\overset{arrow}{\eta}}_{i}}} )_{t}}},\mspace{20mu} {{{if}\mspace{14mu} {\rho (i)}} = {( {t,{\overset{arrow}{v}}_{i}} )}},{{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{z_{t}}},\mspace{79mu} {c_{i}^{({\tau,\kappa,\iota})}:={( {\overset{\overset{n_{t}}{}}{{\delta \; s_{i}{\overset{arrow}{v}}_{i}},{\overset{arrow}{e}}_{i}^{({\tau,\kappa,\iota})},}\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{t}}{}}{0,{\ldots \mspace{14mu} 0},}\overset{\overset{z_{t}}{}}{{\overset{arrow}{\eta}}_{i}}} )_{t}}},\mspace{20mu} {c_{d + 1}:={g_{T}^{\zeta}{msg}}},{{{return}\mspace{14mu} {ct}_{}}:={( {,\begin{Bmatrix}{c_{0,0}^{({\tau,\kappa,\iota})},\ldots \mspace{14mu},c_{0,{\mu + 1}}^{({\tau,\kappa,\iota})},} \\{c_{1}^{({\tau,\kappa,\iota})},\ldots \mspace{14mu},c_{L}^{({\tau,\kappa,\iota})}}\end{Bmatrix}_{{\tau = 1},\; \ldots \mspace{11mu},{m;{\kappa = 0}},\; \ldots \mspace{11mu},{f_{\tau};{\iota = 0}},1},c_{d + 1}} ).}}} & \; \\{{{{{Dec}( {{pk},{{ct}_{}:=( {,\begin{Bmatrix}{c_{0,0}^{({\tau,\kappa,\iota})},\ldots \mspace{14mu},c_{0,{\mu + 1}}^{({\tau,\kappa,\iota})},} \\{c_{1}^{({\tau,\kappa,\iota})},\ldots \mspace{14mu},c_{L}^{({\tau,\kappa,\iota})}}\end{Bmatrix}_{{\tau = 1},\; \ldots \mspace{11mu},{m;{\kappa = 0}},\; \ldots \mspace{11mu},{f_{\tau};{\iota = 0}},1},c_{d + 1}} )},\mspace{20mu} {{sk}_{\Gamma}:=( {\Gamma,k_{0}^{*},\{ k_{t}^{*} \}_{{({t,{\overset{arrow}{x}}_{t}})} \in \Gamma}} )}} )}:\mspace{79mu} {{if}\mspace{14mu} }}:={{( {,\mathcal{B},{d(x)},\rho} )\mspace{14mu} {accepts}\mspace{14mu} \Gamma}:=\{ ( {t,{\overset{arrow}{x}}_{t}} ) \}}},} & \lbrack {{Formula}\mspace{14mu} 184} \rbrack \\{{{{{then}\mspace{14mu} {compute}\mspace{14mu} I_{\delta}} \subseteq \{ {1,\ldots \mspace{14mu},L} \}},( {\alpha_{1},\ldots \mspace{14mu},\alpha_{L}} ),{( {\beta_{1},\ldots \mspace{14mu},\beta_{L}} )\mspace{14mu} {and}}}\mspace{20mu} {{\kappa \mspace{14mu} {with}\mspace{14mu} {h_{\tau,\kappa,\iota}(x)}}:={h_{\tau,\kappa,\iota,0} + {h_{\tau,\kappa,\iota,1}x} + \ldots + {h_{\tau,\kappa,\iota,\mu}x^{\mu}}}}\mspace{20mu} {{{{for}\mspace{14mu} {all}\mspace{14mu} \tau} = 1},\ldots \mspace{14mu},{{m\mspace{14mu} {and}\mspace{14mu} \iota} = 0},{1\mspace{14mu} {such}\mspace{14mu} {that}}}\mspace{20mu} {{{{h_{\tau,\kappa,0}(x)} \cdot {d_{\tau}(x)}^{\kappa}} = {{a_{0}(x)} + {\sum\limits_{i = 1}^{L}{\alpha_{i}{\alpha_{i}(x)}}}}},{and}}\mspace{20mu} {{{{{h_{\tau,\kappa,1}(x)} \cdot {d_{\tau}(x)}}f_{\tau}^{- \kappa}} = {{b_{0}(x)} + {\sum\limits_{i = 1}^{L}{\beta_{i}{b_{i}(x)}}}}},{K_{\tau,0}:={{e( {k_{0}^{*},{\sum\limits_{j = 0}^{\mu}{h_{\tau,\kappa,0,j}c_{0,j}^{({\tau,\kappa,0})}}}} )} \cdot {e( {k_{0}^{*},c_{o,{\mu + 1}}^{({\tau,\kappa,0})}} )} \cdot {\prod\limits_{{i \in I_{\delta}}, +}\; {{e( {k_{t}^{*},c_{i}^{({\tau,\kappa,0})}} )}{\alpha_{i} \cdot {\prod\limits_{{i \in I_{\delta}}, -}\; {{e( {k_{t}^{*},c_{i}^{({\tau,\kappa,0})}} )}{\alpha_{i}/( {{\overset{arrow}{v}}_{i} \cdot {\overset{arrow}{x}}_{t}} )}}}}}}}},}} & \; \\{{{K_{\tau,1}:={{e( {k_{0}^{*},{\sum\limits_{j = 0}^{\mu}{h_{\tau,\kappa,1,j}c_{0,j}^{({\tau,\kappa,1})}}}} )} \cdot {e( {k_{0}^{*},c_{0,{\mu + 1}}^{({\tau,\kappa,1})}} )} \cdot {\prod\limits_{{i \in I_{\delta}}, +}\; {{e( {k_{t}^{*},c_{i}^{({\tau,\kappa,1})}} )}{\beta_{i} \cdot {\prod\limits_{{i \in I_{\delta}}, -}\; {{e( {k_{t}^{*},c_{i}^{({\tau,\kappa,1})}} )}{\beta_{i}/( {{\overset{arrow}{v}}_{i} \cdot {\overset{arrow}{x}}_{t}} )}}}}}}}},\mspace{20mu} {{{where}\mspace{14mu} I_{\delta, +}}:={\{ { {i \in I_{\delta}} \middle| {\rho (i)}  = ( {t,{\overset{arrow}{v}}_{i}} )} \} \mspace{14mu} {and}}}}\mspace{20mu} {I_{\delta, -}:={{{\{ { {i \in I_{\delta}} \middle| {\rho (i)}  = {( {t,{\overset{arrow}{v}}_{i}} )}} \}.\mspace{11mu} \mspace{20mu} {return}}\mspace{14mu} {msg}^{\prime}}:={c_{d + 1}/{( {\prod\limits_{\tau = 1}^{m}\; {K_{\tau,0}K_{\tau,1}}} ).}}}}} & \;\end{matrix}$

The functional encryption scheme has been described above. If the KeyGenalgorithm and Dec algorithm are modified as indicated in Formulas 185 to187, an attribute-based encryption scheme may be realized. With theattribute-based encryption scheme, in the Setup algorithm, n_(t) is2mf_(max)k_(max)+2. The Setup algorithm is the same as the Setupalgorithm indicated in Formula 149, and the Enc algorithm is the same asthe Enc algorithm indicated in Formula 152.

$\begin{matrix}{{{{KeyGen}( {{pk},{sk},{:=( {,\mathcal{B},{{d(x)} = {\prod\limits_{\tau = 1}^{m}\; {d_{\tau}(x)}^{f_{\tau}}}},\rho} )}} )}\text{:}}\mspace{20mu} {{\pi_{\tau}\overset{U}{}_{q}},( {{\tau = 1},\ldots \mspace{14mu},{m - 1}} ),{\pi_{m}:={- {\sum\limits_{\tau = 1}^{m - 1}\pi_{\tau}}}},\mspace{79mu} {\pi_{\tau,\kappa,0}\overset{U}{}_{q}},}} & \lbrack {{Formula}\mspace{14mu} 185} \rbrack \\{{\pi_{\tau,\kappa,1}:={\pi_{\tau} - {\pi_{\tau,\kappa,0}( {{\tau = 1},\ldots \mspace{14mu},{m;{\kappa = 0}},\ldots \mspace{14mu},f_{\tau}} )}}},\mspace{20mu} {\chi_{\tau}\overset{U}{}_{q}},( {{\tau = 1},\ldots \mspace{14mu},{m - 1}} ),{\chi_{m}:={1 - {\sum\limits_{\tau = 1}^{m - 1}\chi_{\tau}}}},\mspace{79mu} {\chi_{\tau,\kappa,0}\overset{U}{}_{q}},{\chi_{\tau,\kappa,1}:={\chi_{\tau} - {\chi_{\tau,\kappa,0}( {{\tau = 1},\ldots \mspace{20mu},{m;{\kappa = 0}},\ldots \mspace{14mu},f_{\tau}} )}}},\mspace{20mu} {{{for}\mspace{14mu} \tau} = 1},\ldots \mspace{14mu},m,{\kappa = 0},\ldots \mspace{20mu},f_{\tau},{\iota = 0},1,\mspace{20mu} {\gamma \overset{U}{}_{q}},{\overset{arrow}{\eta}}_{0,0},\ldots \mspace{14mu},{{\overset{arrow}{\eta}}_{0,{\mu + 1}}\overset{U}{}_{q}^{w_{0}}},\mspace{20mu} {{{for}\mspace{14mu} j} = 0},\ldots \mspace{14mu},\mu,} & \; \\{{k_{0,j}^{*{({\tau,\kappa,0})}}:={( {\overset{\overset{n_{0}}{}}{{\delta ( {{\gamma^{j} \cdot {d_{\tau}(\gamma)}^{\kappa}},{\overset{arrow}{e}}_{0}^{({\tau,\kappa,0})}} )},}\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{0}}{}}{{\overset{arrow}{\eta}}_{0,j},}\overset{\overset{z_{0}}{}}{0,\ldots \mspace{20mu},0}} )_{0}^{*}}},{k_{0,j}^{*{({\tau,\kappa,1})}}:={( {\overset{\overset{n_{0}}{}}{{\delta ( {{\gamma^{j} \cdot {d_{\tau}(\gamma)}^{f_{\tau} - \kappa}},{\overset{arrow}{e}}_{0}^{({\tau,\kappa,1})}} )},}\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{0}}{}}{{\overset{arrow}{\eta}}_{0,j},}\overset{\overset{z_{0}}{}}{0,\ldots \mspace{20mu},0}} )_{0}^{*}}},\mspace{20mu} {s_{0}:={{{- {a_{0}(\gamma)}}\mspace{14mu} {if}\mspace{14mu} \iota} = 0}},{s_{0}:={{{- {b_{0}(\gamma)}}\mspace{14mu} {if}\mspace{14mu} \iota} = 1}},{k_{0,{\mu + 1}}^{*{({\tau,\kappa,\iota})}}:={( {\overset{\overset{n_{0}}{}}{{\delta ( {{s_{0} + \pi_{\tau,\kappa,\iota}},{\overset{arrow}{e}}_{0}^{({\tau,\kappa,\iota})}} )},}\overset{\overset{u_{0}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{0}}{}}{{\overset{arrow}{\eta}}_{0,{\mu + 1}},}\overset{\overset{z_{0}}{}}{0,\ldots \mspace{20mu},0,\chi_{\tau,\kappa,\iota}}} )_{0}^{*}}},} & \; \\{\mspace{79mu} {{{{for}\mspace{14mu} i} = 1},\ldots \mspace{14mu},L,{\xi_{i,\tau,\iota}\overset{U}{}{_{q}( {{i = 1},\ldots \mspace{14mu},{L;{\tau = 1}},\ldots \mspace{14mu},{{m - 1};{\iota = 0}},1} )}},\mspace{20mu} {\xi_{i,m,\iota}:={- {\sum\limits_{\tau = 1}^{m - 1}{\xi_{i,\tau,\iota}( {{i = 1},\ldots \mspace{20mu},{L;{\iota = 0}},1} )}}}},\mspace{20mu} {s_{i}:={{{- {a_{i}(\gamma)}} + {\xi_{i,\tau,0}\mspace{14mu} {if}\mspace{14mu} \iota}} = 0}},\mspace{20mu} {s_{i}:={{{- {b_{i}(\gamma)}} + {\xi_{i,\tau,1}\mspace{14mu} {if}\mspace{14mu} \iota}} = 1}},\mspace{20mu} {{{if}\mspace{14mu} {\rho (i)}} = ( {t,v_{i}} )},{\theta_{i}\overset{U}{}_{q}},{{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{w_{t}}},}} & \lbrack {{Formula}\mspace{14mu} 186} \rbrack \\{{k_{i}^{*{({\tau,\kappa,\iota})}}:={( {\overset{\overset{n_{t}}{}}{{\delta ( {{s_{i} + {\theta_{i}v_{i}} - \theta_{i}},{\overset{arrow}{e}}_{i}^{({\tau,\kappa,\iota})}} )},}\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{t}}{}}{{\overset{arrow}{\eta}}_{i},}\overset{\overset{z_{t}}{}}{0,\ldots \mspace{20mu},0}} )_{t}^{*}}},\mspace{20mu} {{{if}\mspace{14mu} {\rho (i)}} = {( {t,v_{i}} )}},{{\overset{arrow}{\eta}}_{i}\overset{U}{}_{q}^{w_{t}}},\; {k_{i}^{*{({\tau,\kappa,\iota})}}:={( {\overset{\overset{n_{t}}{}}{{\delta( \; {{s_{i}v_{i}},s_{i},{\overset{arrow}{e}}_{i}^{({\tau,\kappa,\iota})}} )},}\overset{\overset{u_{t}}{}}{0,\ldots \mspace{14mu},0,}\overset{\overset{w_{t}}{}}{{\overset{arrow}{\eta}}_{i},}\overset{\overset{z_{t}}{}}{0,\ldots \mspace{20mu},0}} )_{t}^{*}}},{{{return}\mspace{14mu} {sk}_{}}:={( {,\begin{Bmatrix}{k_{0,0}^{*{({\tau,\kappa,\iota})}},\ldots \mspace{14mu},k_{0,{\mu + 1}}^{*{({\tau,\kappa,\iota})}},} \\{k_{1}^{*{({\tau,\kappa,\iota})}},\ldots \mspace{14mu},k_{L}^{*{({\tau,\kappa,\iota})}}}\end{Bmatrix}_{{\tau = 1},\; \ldots \mspace{11mu},{m;{\kappa = 0}},\; \ldots \mspace{11mu},{f_{\tau};{\iota = 0}},1}} ).}}} & \; \\{{{{{Dec}( {{pk},{{sk}_{}:=( {,\begin{Bmatrix}{k_{0,0}^{*{({\tau,\kappa,\iota})}},\ldots \mspace{14mu},k_{0,{\mu + 1}}^{*{({\tau,\kappa,\iota})}},} \\{k_{1}^{*{({\tau,\kappa,\iota})}},\ldots \mspace{14mu},k_{L}^{*{({\tau,\kappa,\iota})}}}\end{Bmatrix}_{{\tau = 1},\; \ldots \mspace{11mu},{m;{\kappa = 0}},\; {{\ldots \mspace{11mu} f_{\tau}};{\iota = 0}},1}} )},\mspace{20mu} {{ct}_{\Gamma}:=( {\Gamma,c_{0},\{ c_{t} \}_{{({t,x_{t}})} \in \Gamma},c_{d + 1}} )}} )}:\mspace{79mu} {{if}\mspace{14mu} }}:={{( {,\mathcal{B},{d(x)},\rho} )\mspace{14mu} {accepts}\mspace{14mu} \Gamma}:=\{ ( {t,x_{t}} ) \}}},} & \lbrack {{Formula}\mspace{14mu} 187} \rbrack \\{{{{{then}\mspace{14mu} {compute}\mspace{14mu} I_{\delta}} \subseteq \{ {1,\ldots \mspace{14mu},L} \}},( {\alpha_{1},\ldots \mspace{14mu},\alpha_{L}} ),{( {\beta_{1},\ldots \mspace{14mu},\beta_{L}} )\mspace{14mu} {and}}}\mspace{20mu} {{\kappa \mspace{14mu} {with}\mspace{14mu} {h_{\tau,\kappa,\iota}(x)}}:={h_{\tau,\kappa,\iota,0} + {h_{\tau,\kappa,\iota,1}x} + \ldots + {h_{\tau,\kappa,\iota,\mu}x^{\mu}}}}\mspace{20mu} {{{{for}\mspace{14mu} {all}\mspace{14mu} \tau} = 1},\ldots \mspace{14mu},{{m\mspace{14mu} {and}\mspace{14mu} \iota} = 0},{1\mspace{14mu} {such}\mspace{14mu} {that}}}\mspace{20mu} {{{{h_{\tau,\kappa,0}(x)} \cdot {d_{\tau}(x)}^{\kappa}} = {{a_{0}(x)} + {\sum\limits_{i = 1}^{L}{\alpha_{i}{\alpha_{i}(x)}}}}},{and}}\mspace{20mu} {{{{{h_{\tau,\kappa,1}(x)} \cdot {d_{\tau}(x)}}f_{\tau}^{- \kappa}} = {{b_{0}(x)} + {\sum\limits_{i = 1}^{L}{\beta_{i}{b_{i}(x)}}}}},{K_{\tau,0}:={{e( {c_{0},{\sum\limits_{j = 0}^{\mu}{h_{\tau,\kappa,0,j}k_{0,j}^{*{({\tau,\kappa,0})}}}}} )} \cdot {e( {c_{0},k_{0,{\mu + 1}}^{*{({\tau,\kappa,0})}}} )} \cdot {\prod\limits_{{i \in I_{\delta}}, +}\; {{e( {c_{t},k_{i}^{*{({\tau,\kappa,0})}}} )}{\alpha_{i} \cdot {\prod\limits_{{i \in I_{\delta}}, -}\; {{e( {c_{t},k_{i}^{*{({\tau,\kappa,0})}}} )}{\alpha_{i}/( {v_{i} \cdot x_{t}} )}}}}}}}},}} & \; \\{{{K_{\tau,1}:={{e( {c_{0},{\sum\limits_{j = 0}^{\mu}{h_{\tau,\kappa,1,j}k_{0,j}^{*{({\tau,\kappa,1})}}}}} )} \cdot {e( {c_{0},k_{0,{\mu + 1}}^{*{({\tau,\kappa,1})}}} )} \cdot {\prod\limits_{{i \in I_{\delta}}, +}\; {{e( {c_{t},k_{i}^{*{({\tau,\kappa,1})}}} )}{\beta_{i} \cdot {\prod\limits_{{i \in I_{\delta}}, -}\; {{e( {c_{t},k_{i}^{*{({\tau,\kappa,1})}}} )}{\beta_{i}/( {v_{i} \cdot x_{t}} )}}}}}}}},\mspace{20mu} {{{where}\mspace{14mu} I_{\delta, +}}:={\{ { {i \in I_{\delta}} \middle| {\rho (i)}  = ( {t,v_{i}} )} \} \mspace{14mu} {and}}}}\mspace{20mu} {I_{\delta, -}:={{{\{ { {i \in I_{\delta}} \middle| {\rho (i)}  = {( {t,v_{i}} )}} \}.\mspace{11mu} \mspace{20mu} {return}}\mspace{14mu} {msg}^{\prime}}:={c_{d + 1}/{( {\prod\limits_{\tau = 1}^{m}\; {K_{\tau,0}K_{\tau,1}}} ).}}}}} & \;\end{matrix}$

By conducting the same modification, the CP-FE scheme indicated inFormulas 181 to 184 can be altered to the attribute-based encryptionscheme.

In the above explanation, n₀+u₀+w₀+z₀ is set in N₀ andn_(t)+u_(t)+w_(t)+z_(t) is set in N_(t). K for example, u₀=n₀, w₀=n₀,and z₀=2, then n₀+n₀+n₀+2=3n₀+2 may be set in N₀. If u_(t)=n_(t),w_(t)=n_(t), and z_(t)=2, then n_(t)+n, +n_(t)+2=3n_(t)+2 may be set inN_(t).

The above explanation presents a functional encryption scheme in which,as with the functional encryption scheme according to Embodiment 2, thelength of the decryption key and ciphertext increases but the number ofbases decreases. Based on the functional encryption scheme according toEmbodiments 3 and 4, the functional encryption scheme according toEmbodiment 4 can be easily transformed into a functional encryptionscheme in which the number of bases increases but the degree number ofeach basis decreases, as with the functional encryption scheme accordingto Embodiment 3.

The above embodiments explained the KP-FE scheme and the CP-FE scheme.The Unified-Policy FE (UP-FE) scheme described in Non-Patent Literature4 can be easily constructed from the KP-FE scheme and the CP-FE scheme.

Embodiment 5

In the above embodiments, the method of implementing the cryptographicprocess in the dual vector spaces has been described. In Embodiment 5, amethod of implementing a cryptographic process in dual additive groupswill be described.

In brief, in the above embodiments, a cryptographic primitive process isimplemented in the cyclic group of the prime order q. If a ring R isexpressed using a composite number M, as in Formula 188, thecryptographic process described in the above embodiments can be appliedto an additive group having a ring R as a coefficient.

:=

/M

  [Formula 188]

where

: an integer; andM: a composite number

If F_(q) in the algorithm explained in the above embodiments is changedto R, the cryptographic primitive process in the dual additive group canbe implemented.

In the above embodiments, from the viewpoint of security proof, ρ(i)concerning each integer i of i=1, . . . , L can be limited to a positivetuple (t, v^(→)) or negative tuple

(t, v^(→)) for different corresponding identification information t.

In other words, let a function ρ^(˜) be map of {1, . . . , L}→{1, . . ., d} being ρ^(˜)(i)=t when ρ(i)=(t, v^(→)) or ρ(i)=

(t, v^(→)). In this case, ρ^(˜) may be limited to injection. Note thatρ(i) is ρ(i) in the access structure S:=(M, ρ(i)) described above.

The hardware configuration of a cryptographic processing system 10 (akey generation device 100, an encryption device 200, and a decryptiondevice 300) in this embodiment will be described.

FIG. 13 is a diagram showing an example of the hardware configuration ofeach of the key generation device 100, the encryption device 200, andthe decryption device 300.

As shown in FIG. 13, each of the key generation device 100, encryptiondevice 200, and decryption device 300 includes a CPU 911 (CentralProcessing Unit; also referred to as central processing device,processing device, computation device, microprocessor, microcomputer, orprocessor) which executes programs. The CPU 911 is connected to a ROM913, a RAM 914, an LCD 901 (Liquid Crystal Display), a keyboard 902(K/B), a communication board 915, and a magnetic disk device 920 via abus 912, and controls these hardware devices. In place of the magneticdisk device 920 (fixed disk device), a storage device such as an opticaldisk device or memory card read/write device may be employed. Themagnetic disk device 920 is connected via a predetermined fixed diskinterface.

The ROM 913 and the magnetic disk device 920 are examples of anonvolatile memory. The RAM 914 is an example of a volatile memory. TheROM 913, the RAM 914, and the magnetic disk device 920 are examples ofthe storage device (memory). The keyboard 902 and the communicationboard 915 are examples of an input device. The communication board 915is an example of a communication device. Furthermore, the LCD 901 is anexample of a display device.

The magnetic disk device 920, ROM 913, or the like stores an operatingsystem 921 (OS), a window system 922, programs 923, and files 924. TheCPU 911, the operating system 921, and the window system 922 executeeach program of the programs 923.

The programs 923 store software and programs that execute the functionsdescribed as the “master key generation part 110”, “master key storagepart 120”, “information input part 130”, “decryption key generation part140”, “key distribution part 150”, “public parameter acquisition part210”, “information input part 220”, “encrypted data generation part230”, “data transmission part 240”, “information acquisition part 310”,“span program calculation part 320”, “complementary coefficientcalculation part 330”, “decryption part 340”, and the like in the abovedescription, and other programs. The programs are read and executed bythe CPU 911.

The files 924 store information, data, signal values, variable values,and parameters such as the “public parameters pk”, “master secret keysk”, “decryption keys sk_(v) and sk_(Γ)”, “ciphertexts ct_(Γ) andct_(s)”, “access structure S”, “attribute information”, “message msg”,and the like of the above explanation, as the items of a “file” and“database”. The “file” and “database” are stored in a recording mediumsuch as a disk or memory. The information, data, signal values, variablevalues, and parameters stored in the recording medium such as the diskor memory are read out to the main memory or cache memory by the CPU 911through a read/write circuit, and are used for the operations of the CPU911 such as extraction, search, look-up, comparison, computation,calculation, process, output, print, and display. The information, data,signal values, variable values, and parameters are temporarily stored inthe main memory, cache memory, or buffer memory during the operations ofthe CPU 911 including extraction, search, look-up, comparison,computation, calculation, process, output, print, and display.

The arrows of the flowcharts in the above explanation mainly indicateinput/output of data and signals. The data and signal values arerecorded in the memory of the RAM 914, the recording medium such as anoptical disk, or in an IC chip. The data and signals are transmittedonline via a transmission medium such as the bus 912, signal lines, orcables; or electric waves.

The “part” in the above explanation may be a “circuit”, “device”,“equipment”, “means” or “function”; or a “step”, “procedure”, or“process”. The “device” may be a “circuit”, “equipment”, “means”, or“function”; or a “step”, “procedure”, or “process”. The “process” may bea “step”. Namely, the “part” may be implemented by firmware stored inthe ROM 913. Alternatively, the “part” may be implemented by onlysoftware; by only hardware such as an element, a device, a substrate, ora wiring line; by a combination of software and hardware; or furthermoreby a combination of software, hardware, and firmware. The firmware andsoftware are stored, as a program, in the recording medium such as theROM 913. The program is read by the CPU 911 and executed by the CPU 911.Namely, the program causes the computer or the like to function as a“part” described above. Alternatively, the program causes the computeror the like to execute the procedure and method of the “part” describedabove.

REFERENCE SIGNS LIST

100: key generation device; 110: master key generation part; 120: masterkey storage part; 130: information input part; 140: decryption keygeneration part; 141: secret information generation part; 142: keyelement generation part; 150: key distribution part; 200: encryptiondevice; 210: public parameter acquisition part; 220: information inputpart; 230: encrypted data generation part; 240: data transmission part;300: decryption device; 311: decryption key acquisition part; 312:ciphertext acquisition part; 320: span program calculation part; 330:complementary coefficient calculation part; 331: polynomial selectionpart; 332: coefficient calculation part; 340: decryption part; 341:pairing operation part; 342: message calculation part

1-13. (canceled)
 14. A cryptographic system comprising an encryptiondevice and a decryption device, the encryption device comprising: aciphertext generation part which generates one of first informationincluding a polynomial d(x), a plurality of polynomials D_(i)(x), andpredicate information and second information including attributeinformation, as a ciphertext; the decryption device comprising: apolynomial selection part which, treating a remaining one of the firstinformation and the second information, as a decryption key and based onthe predicate information included in the first information and theattribute information included in the second information, selects atleast one polynomial D_(i)(x) from the plurality of polynomialsD_(i)(x), a coefficient calculation part which calculates a coefficientΔ_(i) that enables a polynomial constituted based on a polynomialΔ_(i)D_(i)(x) to be divided out by the polynomial d(x), the polynomialΔ_(i)D_(i)(x) being obtained by multiplying the polynomial D_(i)(x)selected by the polynomial selection part, by the coefficient Δ_(i), anda decryption part which decrypts the ciphertext based on the coefficientΔ_(i) calculated by the coefficient calculation part.
 15. Thecryptographic system according to claim 14, wherein the plurality ofpolynomials D_(i)(x) include a polynomial a_(i)(x) and a polynomialb_(i)(x) concerning each integer i of i=0, . . . , L, L being an integerof 1 or more, wherein the polynomial selection part, based on theattribute information and the predicate information, selects a set I ofan integer i out of i=1, . . . , L, thereby selecting a polynomial a₀(x)and a polynomial b₀(x), and the polynomial a_(i)(x) and the polynomialb_(i)(x) concerning the integer i included in the set I, and wherein thecoefficient calculation part calculates, as the coefficient Δ_(i), acoefficient α_(i) and a coefficient β_(i) that enable(a₀(x)+Σ_(iεI)α_(i)a_(i)(x))·(b₀(x)+Σ_(iεI)β_(i)b_(i)(x)) to be dividedout by the polynomial d(x).
 16. The cryptographic system according toclaim 15, wherein the polynomial d(x) is factorized into a polynomiald_(τ)(x)^(fτ) where τ=1, . . . , m, m being an integer of 1 or more,wherein the coefficient calculation part calculates the coefficientα_(i), the coefficient β_(i), and a degree κ_(τ) that enable Π_(τ=1)^(m)d_(τ)(x)^(κτ) to divide out (a₀(x)+Σ_(iεI)α_(i)a_(i)(x)) and enableΠ_(τ=1) ^(m)d_(τ)(x)^(fτ-κτ) to divide out (b₀(x)+Σ_(iεI)β_(i)b_(i)(x)),and wherein the decryption part decrypts the ciphertext based on thecoefficient α_(i), the coefficient β_(i), and the degree κ_(τ).
 17. Thecryptographic system according to claim 15, wherein the attributeinformation includes an attribute vector x^(→) _(t) concerning at leastone integer t of t=1, . . . , d, d being an integer of 1 or more,wherein the predicate information includes a tuple (t, v^(→) _(i)) of anidentifier t and a predicate vector v^(→) _(i) concerning each integer iof i=1, . . . , L, and wherein the polynomial selection part determines,concerning the tuple (t, v^(→) _(i)) concerning each integer i of i=1, .. . , L, whether or not the integer i is to be included in the set I,based on whether or not an inner-product of the predicate vector v^(→)_(i) of the tuple and the attribute vector x^(→) _(t) concerning theidentification information t of the tuple is
 0. 18. The cryptographicsystem according to claim 17, wherein the tuple (t, v^(→) _(i)) isrelated to either one of a positive tuple and a negative tuple, andwherein the polynomial selection part, when the tuple (t, v^(→) _(i)) isrelated to the positive tuple, includes the integer i into the set I ifthe inner-product is 0, and when the tuple (t, v^(→) _(i)) is related tothe negative tuple, includes the integer i into the set I if theinner-product is not
 0. 19. The cryptographic system according to claim14, wherein the polynomial d(x) is factorized into a polynomiald_(τ)(x)^(fτ) where τ=1, . . . , m, m being an integer of 1 or more,wherein the first information includes, for each polynomiald_(τ)(x)^(fτ), an element in which information obtained by thepolynomial d_(τ)(x)^(fτ) is set, and wherein the decryption partdecrypts the ciphertext based on the coefficient Δ_(i) and the element.20. The cryptographic system according to claim 19, wherein the firstinformation includes, for each polynomial d_(τ)(x)^(fτ) and concerningeach integer κ of κ=0, . . . , f_(Γ) and each integer i of i=0, . . . ,L, an element in which a remainder of dividing the polynomial a_(i)(x)by a polynomial d_(τ)(x)^(κ) is set and an element in which a remainderof dividing the polynomial b_(i)(x) by a polynomial d_(τ)(x)^(κ) is set.21. The cryptographic system according to claim 19, wherein the firstinformation includes, for each polynomial d_(τ)(x)^(fτ), an element inwhich a value substituted by a predetermined value γ is set.
 22. Thecryptographic system according to claim 19, wherein the decryption partcarries out, based on the coefficient Δ_(i), a predetermined operationconcerning the element in order to render information obtained from thepolynomial d_(τ)(x)^(fτ) to 0, thereby decrypting the ciphertext.
 23. Acryptographic method comprising: a ciphertext generation step of, withan encryption device, generating one of first information including apolynomial d(x), a plurality of polynomials D_(i)(x), and predicateinformation and second information including attribute information, as aciphertext; a polynomial selection step of, with a decryption device,treating a remaining one of the first information and the secondinformation, as a decryption key and based on the predicate informationincluded in the first information and the attribute information includedin the second information, selecting at least one polynomial D_(i)(x)from the plurality of polynomials D_(i)(x); a coefficient calculationstep of, with the decryption device, calculating a coefficient Δ_(i)that enables a polynomial constituted based on a polynomialΔ_(i)D_(i)(x) to be divided out by the polynomial d(x), the polynomialΔ_(i)D_(i)(x) being obtained by multiplying the polynomial D_(i)(x)selected in the polynomial selection step, by the coefficient Δ_(i); anda decryption step of, with the decryption device, decrypting theciphertext based on the coefficient Δ_(i) calculated in the coefficientcalculation step.
 24. A non-transitory computer readable mediumincluding a cryptographic program which causes a computer to execute: aciphertext generation process of generating one of first informationincluding a polynomial d(x), a plurality of polynomials D_(i)(x), andpredicate information and second information including attributeinformation, as a ciphertext; a polynomial selection process of,treating a remaining one of the first information and the secondinformation, as a decryption key and based on the predicate informationincluded in the first information and the attribute information includedin the second information, selecting at least one polynomial D_(i)(x)from the plurality of polynomials D_(i)(x); a coefficient calculationprocess of calculating a coefficient A, that enables a polynomialconstituted based on a polynomial Δ_(i)D_(i)(x) to be divided out by thepolynomial d(x), the polynomial Δ_(i)D_(i)(x) being obtained bymultiplying the polynomial D_(i)(x) selected in the polynomial selectionprocess, by the coefficient Δ_(i); and a decryption process ofdecrypting the ciphertext based on the coefficient Δ_(i) calculated inthe coefficient calculation process.
 25. A decryption device comprising:an information acquisition part which acquires one of first informationincluding a polynomial d(x), a plurality of polynomials D_(i)(x), andpredicate information and second information including attributeinformation, as a ciphertext, and a remaining one of the firstinformation and the second information, as a decryption key; apolynomial selection part which, based on the predicate informationincluded in the first information and the attribute information includedin the second information, the first information and the secondinformation being generated by the information acquisition part, selectsat least one polynomial D_(i)(x) from the plurality of polynomialsD_(i)(x); a coefficient calculation part which calculates a coefficientΔ_(i) that enables a polynomial constituted based on a polynomialΔ_(i)D_(i)(x) to be divided out by the polynomial d(x), the polynomialΔ_(i)D_(i)(x) being obtained by multiplying the polynomial D_(i)(x)selected by the polynomial selection part, by the coefficient Δ_(i); anda decryption part which decrypts the ciphertext by the decryption keybased on the coefficient Δ_(i) calculated by the coefficient calculationpart.